The flaw permits authenticated users with system permission to execute arbitrary PHP code on the web server via the language pack import feature. By crafting a ZIP archive that contains a .inc file and uploading it through import_language.php, an attacker can cause the server to read that file when the language parameter is set, leading to remote code execution. The vulnerability is an insecure file upload flaw (CWE‑434) that can compromise confidentiality, integrity, and availability of the affected system.

The issue affects theXerteProject Xerte Online Toolkits version 3.15.5 and all earlier releases. Users running those versions in a web-hosted environment without the vendor patch are vulnerable.

The CVSS score of 8.6 classifies this as high severity. Although no EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, the attack requires authenticated users with system permission, which narrows the threat surface. No public exploit has been observed, but the ability to run arbitrary PHP could allow full server compromise if attackers gain or abuse appropriate credentials.