CVE-2026-32985 — AI Deep Analysis Summary

Q: Root Cause? (CWE/Flaw)

🛡️ **Root Cause**: **CWE-306** (Missing Authentication for Critical Function). ❌ **Flaw**: The system fails to verify the authenticity or safety of uploaded template files before processing them.

Q: Who is affected? (Versions/Components)

📦 **Affected**: **Xerte Online Toolkits**. 📅 **Versions**: **3.14 and earlier**. 🏢 **Vendor**: Xerte (UK-based learning content platform).

Q: What can hackers do? (Privileges/Data)

🔓 **Privileges**: **Remote Code Execution (RCE)**. 📊 **Impact**: Full control over the server. Attackers can read, modify, or delete any data. **High** Confidentiality, Integrity, and Availability impact.

Q: Is exploitation threshold high? (Auth/Config)

🔑 **Threshold**: **LOW**. 🌐 **Access**: **Network** accessible (AV:N). 🔒 **Auth**: **None required** (PR:N, UI:N). No login or user interaction needed to exploit.

Q: Is there a public Exp? (PoC/Wild Exploitation)

💣 **Public Exploit**: **YES**. 📄 **Source**: Packet Storm listing confirms **Shell Upload** exploits are available. ⚠️ **Status**: Wild exploitation is highly likely given low barrier.

Q: Is it fixed officially? (Patch/Mitigation)

🩹 **Fix**: Upgrade to a version **newer than 3.14**. 🔗 **Vendor**: Check [xot.xerte.org.uk](https://xot.xerte.org.uk/) for official patches. ⏳ **Published**: March 20, 2026.

Q: What if no patch? (Workaround)

🚧 **Workaround**: If no patch: 1. **Disable** the template import feature entirely. 2. **Restrict** access to the upload endpoint via WAF/Network ACLs. 3. Validate all uploaded files strictly server-side.

Q: Is it urgent? (Priority Suggestion)

🔥 **Urgency**: **CRITICAL**. ⚡ **Priority**: **Immediate Action Required**. 📉 **Risk**: CVSS **9.8** (Critical). No auth needed + RCE = High probability of compromise.

Updated May 08, 2026 CVSS 9.8 · Critical

This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis →

Q1What is this vulnerability? (Essence + Consequences)

🚨 **Essence**: Xerte Online Toolkits allows **unvalidated arbitrary file uploads** via template import. <br>💥 **Consequences**: Attackers can upload malicious scripts, leading to **Remote Code Execution (RCE)**.…

Read full answer (login)

Q2Root Cause? (CWE/Flaw)

🛡️ **Root Cause**: **CWE-306** (Missing Authentication for Critical Function). <br>❌ **Flaw**: The system fails to verify the authenticity or safety of uploaded template files before processing them.

Q3Who is affected? (Versions/Components)

📦 **Affected**: **Xerte Online Toolkits**. <br>📅 **Versions**: **3.14 and earlier**. <br>🏢 **Vendor**: Xerte (UK-based learning content platform).

Q4What can hackers do? (Privileges/Data)

🔓 **Privileges**: **Remote Code Execution (RCE)**. <br>📊 **Impact**: Full control over the server. Attackers can read, modify, or delete any data. **High** Confidentiality, Integrity, and Availability impact.

Q5Is exploitation threshold high? (Auth/Config)

🔑 **Threshold**: **LOW**. <br>🌐 **Access**: **Network** accessible (AV:N). <br>🔒 **Auth**: **None required** (PR:N, UI:N). No login or user interaction needed to exploit.

Q6Is there a public Exp? (PoC/Wild Exploitation)

💣 **Public Exploit**: **YES**. <br>📄 **Source**: Packet Storm listing confirms **Shell Upload** exploits are available. <br>⚠️ **Status**: Wild exploitation is highly likely given low barrier.

Q7How to self-check? (Features/Scanning)

🔍 **Self-Check**: Scan for **Template Import** features. <br>🧪 **Test**: Attempt to upload non-template files (e.g., PHP/JS shells) to the import endpoint.…

Read full answer (login)

Q8Is it fixed officially? (Patch/Mitigation)

🩹 **Fix**: Upgrade to a version **newer than 3.14**. <br>🔗 **Vendor**: Check [xot.xerte.org.uk](https://xot.xerte.org.uk/) for official patches. <br>⏳ **Published**: March 20, 2026.

Q9What if no patch? (Workaround)

🚧 **Workaround**: If no patch: <br>1. **Disable** the template import feature entirely. <br>2. **Restrict** access to the upload endpoint via WAF/Network ACLs. <br>3. Validate all uploaded files strictly server-side.

Q10Is it urgent? (Priority Suggestion)

🔥 **Urgency**: **CRITICAL**. <br>⚡ **Priority**: **Immediate Action Required**. <br>📉 **Risk**: CVSS **9.8** (Critical). No auth needed + RCE = High probability of compromise.

Continue exploring

Vulnerability detail Full AI analysis (login) Xerte CWE-306