The flaw allows an attacker to obtain the full filesystem path to the application root without authentication by sending a GET request to the /setup page. The root_path value is rendered into the page’s HTML, revealing the directory structure and enabling further exploitation of path-dependent weaknesses such as relative path traversal in connector.php.

Xerte Online Toolkits versions 3.15 and earlier, developed by thexerteproject. The vulnerability affects all installations using these releases; newer versions are not impacted.

With a CVSS score of 6.9, the risk is moderate, and the EPSS score is not available, suggesting there is some uncertainty about how often the flaw is exploited in the wild. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit it unauthenticated via a browser or automated tool, exposing the system path and potentially facilitating additional attacks such as directory traversal. The primary security consequence is the disclosure of internal directory structure, which can aid attackers in planning further exploits.