Executive brief
Xerte Online Toolkits, an open-source platform for creating interactive learning materials, contains a security flaw that reveals the server's internal folder structure to anyone on the internet. By visiting a specific setup page, an unauthorized person can see exactly where the application is installed on the server's hard drive. While this information seems minor on its own, it is often used by attackers as a stepping stone to launch more serious attacks, such as taking full control of the server or accessing private files.
Technical details
An information disclosure vulnerability exists in Xerte Online Toolkits versions 3.15 and earlier due to the exposure of sensitive system information in the setup component. Specifically, the 'software_installed.php' file within the /setup directory renders the '$xot_setup->root_path' variable directly into the HTML response. An unauthenticated remote attacker can trigger this by sending a GET request to the /setup page. The resulting disclosure of the absolute filesystem path can be leveraged to facilitate more complex attacks, such as providing the necessary path information for relative path traversal exploits in 'connector.php'. A patch has been committed to the project's repository to remove the path disclosure.
Affected products
- thexerteproject Xerte Online Toolkits 3.15 and earlier
Timeline
- 2026-03-23: disclosed: Initial researcher contact via GitHub issue
- 2026-04-22: advisory: VulnCheck published advisory
- 2026-04-22: patched: Fix committed to GitHub repository
References
- https://github.com/bootstrapbool/xerteonlinetoolkits-rce
- https://github.com/thexerteproject/xerteonlinetoolkits/commit/f063e942b4a9bf77a06829e844c2c70316bc45e8
- https://github.com/thexerteproject/xerteonlinetoolkits/issues/1527
- https://www.vulncheck.com/advisories/xerte-online-toolkits-path-disclosure-via-setup
- https://xerte.org.uk/index.php/en/downloads-1/category/3-xerte-online-toolkits
- https://xerte.org.uk/xertetoolkits_3.15_ChangeLog.html