CVE-2026-4813Disclosure

LOWCVSS 9.4 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

A vulnerability in the Lutece Core XSL export management module up to version 7.1.7, which allows authenticated administrators to execute code remotely. The XML/XSLT processing configuration does not enable secure processing mode (FEATURE_SECURE_PROCESSING), allowing Java extension functions to be executed from malicious XSL stylesheets. An attacker with administrator privileges can upload a manipulated XSL transformation file and trigger its execution during user export operations, resulting in the execution of arbitrary code on the server.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

http://incibe.es/en/incibe-cert/notices/aviso/code-injection-lutece-core

Weakness type (CWE)

CWE-94

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

2 mentions across 2 observed days
Momentum state: stable

What's happening

Technical details provided in 2 signals
Disclosure: 1 classified signal
General: 1 classified signal
Peaked 1d ago at 1 mentions (2026-09-01); latest day: 1
2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d

Signal classification2 categories

Disclosure

150.0%

General

150.0%

Referenced assets2 URLs

By indicator

Classification over time

Date	Total	Labels

2026-09-01	1	Disclosure1
2026-09-03	1	General1

Full discourse2 posts

Cyber Threat Observatory | Alan Turing Institute@TuringCyberObs44d
General
CVE-2026-4813 Lutece Core Remote code execution in a municipal CMS framework could compromise citizen-facing portals, service forms and institutional communications Full analysis: https://github.com/alan-turing-institute/cyber-threat-observatory/blob/main/reports/2026-09-01/TIER_2_CVE-2026-4813.md #CyberSecurity #PublicSector #VulnerabilityManagement
Post summary
The snippet reports a remote code execution vulnerability (CVE‑2026‑4813) in Lutece Core and points to a full analysis report, but provides no PoC, exploit code, or evidence of active exploitation.
0000036
61 followersView on X
INCIBE-CERT@incibe_cert46d
Disclosure
⚠️#INCIBEaviso | Inyección de código en el Core de #Lutece #CVE CVE-2026-4813 https://www.incibe.es/incibe-cert/alerta-temprana/avisos/inyeccion-de-codigo-en-el-core-de-lutece #AvisosDeSeguridad #TI #CNA #0day
Post summary
An INCIBE alert announces a code‑injection vulnerability (CVE‑2026‑4813) in the Lutece core, with minimal details beyond the vulnerability type.
0000067
49 followersView on X

Explore more

Back to dashboard