CVE-2021-44664

An Authenticated Remote Code Exection (RCE) vulnerability exists in Xerte through 3.9 in website_code/php/import/fileupload.php by uploading a maliciously crafted PHP file though the project interface disguised as a language file to bypasses the upload filters. Attackers can manipulate the files destination by abusing path traversal in the 'mediapath' variable.

• CWE-22
• CWE-434

• http://packetstormsecurity.com/files/166182/Xerte-3.9-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
• https://github.com/thexerteproject/xerteonlinetoolkits/commit/1672d6f46bbd6f6d42f0903ce9a313927ae2836b#diff-27433bb0be90e431d40986f9afebe9ee2f8d1025a7f9e55c3cd7a86f1f8e3fdcPatch, Third Party Advisory
• https://github.com/thexerteproject/xerteonlinetoolkits/commit/6daeb81d089d4a561e22f931fff1327660a7d1b5Patch, Third Party Advisory
• https://riklutz.nl/2021/11/03/authenticated-file-upload-to-remote-code-execution-in-xerte/Exploit, Third Party Advisory
• http://packetstormsecurity.com/files/166182/Xerte-3.9-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
• https://github.com/thexerteproject/xerteonlinetoolkits/commit/1672d6f46bbd6f6d42f0903ce9a313927ae2836b#diff-27433bb0be90e431d40986f9afebe9ee2f8d1025a7f9e55c3cd7a86f1f8e3fdcPatch, Third Party Advisory
• https://github.com/thexerteproject/xerteonlinetoolkits/commit/6daeb81d089d4a561e22f931fff1327660a7d1b5Patch, Third Party Advisory
• https://riklutz.nl/2021/11/03/authenticated-file-upload-to-remote-code-execution-in-xerte/Exploit, Third Party Advisory

Published

Feb 24, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-44655Online Pre-owned/Used Car Showroom Management System 1.0 con…9.8
• CVE-2021-44657In StackStorm versions prior to 3.6.0, the jinja interpreter…8.8
• CVE-2021-44659Adding a new pipeline in GoCD server version 21.3.0 has a fu…9.8
• CVE-2021-4466IPCop versions up to and including 2.1.9 contain an authenti…8.7
• CVE-2021-44662A Site Scripting (XSS) vulnerability exists in the Xerte Pro…6.1
• CVE-2021-44663A Remote Code Execution (RCE) vulnerability exists in the Xe…9.8
• CVE-2021-44665A Directory Traversal vulnerability exists in the Xerte Proj…6.5
• CVE-2021-44667A Cross Site Scripting (XSS) vulnerability exists in Nacos 2…6.1
• CVE-2021-4467Positive Technologies MaxPatrol 8 and XSpider contain a remo…8.7
• CVE-2021-44673A Remote Code Execution (RCE) vulnerability exists in Croogo…8.8
• CVE-2021-44674An information exposure issue has been discovered in Opmante…6.5
• CVE-2021-44675Zoho ManageEngine ServiceDesk Plus MSP before 10.5 Build 105…9.8