CVE-2026-4813: CWE-94 in Lutece Lutece Core

This vulnerability affects Lutece Core's XSL export management module up to version 7.1.7. The XML/XSLT processing configuration lacks the FEATURE_SECURE_PROCESSING setting, which normally restricts execution of potentially dangerous Java extension functions. An attacker with administrator privileges can upload a crafted XSL stylesheet that includes malicious Java code. When the export operation triggers the XSL transformation, the malicious code executes on the server, resulting in remote code execution. The CVSS 4.0 score is 9.4, indicating critical severity. No patch or official remediation has been provided in the available data.

An attacker with administrator privileges can achieve remote code execution on the server hosting Lutece Core by exploiting this vulnerability. This could lead to full system compromise, data theft, or disruption of services. The vulnerability requires authenticated administrator access, which limits the attack surface but still poses a severe risk given the high privileges required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted personnel only and monitor for suspicious activity related to XSL export operations. Avoid uploading untrusted XSL stylesheets. Follow vendor communications closely for updates on patches or mitigations.