# CVE-2026-41459: thexerteproject Xerte Online Toolkits path disclosure in setup page

Source: https://junglewise.ai/threats/cve-2026-41459-thexerteproject-xerte-online-toolkits-path-disclosure-in-setup  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-22. Updated: 2026-07-14  
License: CC BY 4.0 with a link back

CVE-2026-41459 · Severity: medium · CVSS 5.3 · Published 2026-04-22

Xerte Online Toolkits, an open-source platform for creating interactive learning materials, contains a security flaw that reveals the server's internal folder structure to anyone on the internet. By visiting a specific setup page, an unauthorized person can see exactly where the application is installed on the server's hard drive. While this information seems minor on its own, it is often used by attackers as a stepping stone to launch more serious attacks, such as taking full control of the server or accessing private files.

Technologies: [The Xerte Project Xerte Online Toolkits](https://junglewise.ai/threats/technologies/xerte-online-toolkits). Vendors: [The Xerte Project](https://junglewise.ai/threats/vendors/the-xerte-project).

## Quick answers

**Is CVE-2026-41459 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-41459 being exploited in the wild.

**How severe is CVE-2026-41459?** Medium severity, with a CVSS score of 5.3, published 22 April 2026.

**Which products and versions are affected?** The Xerte Project Xerte Online Toolkits 3.15 and earlier.

**Is there a fix for CVE-2026-41459?** A patch was published on 2026-04-22: Fix committed to GitHub repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-41459 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-41459?** Check whether you run The Xerte Project Xerte Online Toolkits at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An information disclosure vulnerability exists in Xerte Online Toolkits versions 3.15 and earlier due to the exposure of sensitive system information in the setup component. Specifically, the 'software_installed.php' file within the /setup directory renders the '$xot_setup->root_path' variable directly into the HTML response. An unauthenticated remote attacker can trigger this by sending a GET request to the /setup page. The resulting disclosure of the absolute filesystem path can be leveraged to facilitate more complex attacks, such as providing the necessary path information for relative path traversal exploits in 'connector.php'. A patch has been committed to the project's repository to remove the path disclosure.

## Affected products

- thexerteproject Xerte Online Toolkits 3.15 and earlier

## Timeline

- 2026-03-23: disclosed: Initial researcher contact via GitHub issue
- 2026-04-22: advisory: VulnCheck published advisory
- 2026-04-22: patched: Fix committed to GitHub repository

## References

- [https://github.com/bootstrapbool/xerteonlinetoolkits-rce](https://github.com/bootstrapbool/xerteonlinetoolkits-rce)
- [https://github.com/thexerteproject/xerteonlinetoolkits/commit/f063e942b4a9bf77a06829e844c2c70316bc45e8](https://github.com/thexerteproject/xerteonlinetoolkits/commit/f063e942b4a9bf77a06829e844c2c70316bc45e8)
- [https://github.com/thexerteproject/xerteonlinetoolkits/issues/1527](https://github.com/thexerteproject/xerteonlinetoolkits/issues/1527)
- [https://www.vulncheck.com/advisories/xerte-online-toolkits-path-disclosure-via-setup](https://www.vulncheck.com/advisories/xerte-online-toolkits-path-disclosure-via-setup)
- [https://xerte.org.uk/index.php/en/downloads-1/category/3-xerte-online-toolkits](https://xerte.org.uk/index.php/en/downloads-1/category/3-xerte-online-toolkits)
- [https://xerte.org.uk/xertetoolkits_3.15_ChangeLog.html](https://xerte.org.uk/xertetoolkits_3.15_ChangeLog.html)

## Related threats

- [The Xerte Project Xerte Online Toolkits RCE via antivirus binary path configuration](https://junglewise.ai/threats/cve-2026-12116-the-xerte-project-xerte-online-toolkits-rce-via-antivirus-binary)
- [The Xerte Project Xerte Online Toolkits RCE in elFinder connector](https://junglewise.ai/threats/cve-2026-34415-the-xerte-project-xerte-online-toolkits-rce-in-elfinder-connector)
- [The Xerte Project Xerte Online Toolkits path traversal in elFinder connector](https://junglewise.ai/threats/cve-2026-34414-the-xerte-project-xerte-online-toolkits-path-traversal-in)
- [The Xerte Project Xerte Online Toolkits auth bypass in elFinder connector](https://junglewise.ai/threats/cve-2026-34413-the-xerte-project-xerte-online-toolkits-auth-bypass-in-elfinder)