Veille CVE

‹ Retour à la liste

CVE-2026-4813

9.4 Critique

Publiée le 01/09/2026 à 13:16 · Modifiée le 01/09/2026 à 22:50 · Analyse NVD reportée · Source : cve-coordination@incibe.es

Description

A vulnerability in the Lutece Core XSL export management module up to version 7.1.7, which allows authenticated administrators to execute code remotely. The XML/XSLT processing configuration does not enable secure processing mode (FEATURE_SECURE_PROCESSING), allowing Java extension functions to be executed from malicious XSL stylesheets. An attacker with administrator privileges can upload a manipulated XSL transformation file and trigger its execution during user export operations, resulting in the execution of arbitrary code on the server.

Traduire en français

Produits concernés

Scores CVSS

VersionScoreSourceVecteur
4.0 9.4 Critique cve-coordination@incibe.es CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Faiblesses (CWE)

Références

Ailleurs