| Package | Affected versions | Patched versions |
|---|---|---|
| xerte | ≤ 3.9 |
An Authenticated Remote Code Exection (RCE) vulnerability exists in Xerte through 3.9 in website_code/php/import/fileupload.php by uploading a maliciously crafted PHP file though the project interface disguised as a language file to bypasses the upload filters. Attackers can manipulate the files destination by abusing path traversal in the 'mediapath' variable.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free