CVE-2026-4813: Code injection in the Lutece Core
A vulnerability in the Lutece Core XSL export management module up to version 7.1.7, which allows authenticated administrators to execute code remotely. The XML/XSLT processing configuration does not enable secure processing mode (FEATURESECUREPROCESSING), allowing Java extension functions to be executed from malicious XSL stylesheets. An attacker with administrator privileges can upload a manipulated XSL transformation file and trigger its execution during user export operations, resulting in the execution of arbitrary code on the server.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 7.1.9 - Configuration
Enable secure processing mode (FEATURE_SECURE_PROCESSING) in the XML/XSLT processing configuration to prevent execution of Java extension functions from malicious XSL stylesheets.
Lutece Core XSL export management module (XML/XSLT processing) FEATURE_SECURE_PROCESSING = enabled
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs authenticated administrator privileges in Lutece Core and the ability to upload a manipulated XSL transformation file. Exploitation is triggered when a user export operation processes that stylesheet.
Which deployments are affected?
The affected component is the Lutece Core XSL export management module through version 7.1.7. The issue depends on XML/XSLT processing not enabling FEATURE_SECURE_PROCESSING.
What is the impact of successful exploitation?
A successful attacker can execute arbitrary code remotely on the server by invoking Java extension functions from a malicious XSL stylesheet.