CVE-2026-4813

Lutece Core's XSL export management module performs XSLT processing without enabling Java's secure processing mode (FEATURE_SECURE_PROCESSING), so XSL stylesheets can invoke Java extension functions. An authenticated administrator can upload a crafted XSL transformation file, which is executed when a user export operation runs, resulting in arbitrary code execution on the server. An attacker who controls an administrator account therefore gains full server-level code execution, going beyond the application's usual admin capabilities. Any deployment of Lutece Core up to and including version 7.1.7 that uses the XSL export management module is affected, notably the French public-sector and municipal sites that run this Java CMS. No public proof of concept, in-the-wild exploitation, or KEV listing is currently known (EPSS 0.3%).

What to do: Upgrade Lutece Core to the first release after 7.1.7 that enables secure XSLT processing (FEATURE_SECURE_PROCESSING) as soon as a patched version is published; the advisory data does not confirm a specific fixed version number. Interim mitigations: restrict XSL uploads to trusted administrators, review existing uploaded XSL transformation files for Java extension function calls, and monitor server processes and file writes during user export operations.