Code injection in the Lutece Core
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-94.
Summary
A vulnerability in the Lutece Core XSL export management module up to version 7.1.7, which allows authenticated administrators to execute code remotely. The XML/XSLT processing configuration does not enable secure processing mode (FEATURE_SECURE_PROCESSING), allowing Java extension functions to be executed from malicious XSL stylesheets. An attacker with administrator privileges can upload a manipulated XSL transformation file and trigger its execution during user export operations, resulting in the execution of arbitrary code on the server.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
- Fix · CNA Lutece Core (Lutece) Fixed in 7.1.7
Timeline
- 2026-10-02 Threatist record created from CVE-2026-4813
- 2026-10-03 Alias added: GHSA-wvvp-v69c-rj86
More Lutece vulnerabilities
- TI-2005-04144 Cross-site scripting (XSS) vulnerability in Lutece 1.2.3 and earlier allows remote… CVSS 2.0MEDIUM 4.3
Sources
- CVE-2026-4813 · CVE Program
- CVE-2026-4813 · NVD
- FIRST EPSS
- GHSA-wvvp-v69c-rj86 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences