CVE-2026-41459 Xerte Online Toolkits Path Disclosure via /setup
Unauthenticated attackers can retrieve the server-side filesystem path via the /setup page, aiding further attacks like path traversal.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-41459?
CVE-2026-41459 is a medium-severity vulnerability in thexerteproject xerteonlinetoolkits, published on 22 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Xerte Online Toolkits versions 3.15 and earlier contain an information disclosure vulnerability that allows unauthenticated attackers to retrieve the full server-side filesystem path of the application root. Attackers can send a GET request to the /setup page to access the exposed root_path value rendered in the HTML response, which enables exploitation of path-dependent vulnerabilities such as relative path traversal in connector.php.
Weakness: CWE-497
Which versions are affected by CVE-2026-41459?
How do I fix CVE-2026-41459?
No fix has been published for CVE-2026-41459 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-41459 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-41459 exists.
Public exploit code: 1 Metasploit module.
Sources
Also known as GHSA-53wm-fw97-q62h.