CVE-2026-32985 is a critical vulnerability in Xerte Online Toolkits (versions 3.14 and earlier) involving missing authentication for a critical function (CWE-306) combined with an arbitrary file upload issue (CWE-434). The vulnerability exists in the import.php file, which does not enforce authentication checks, allowing attackers to upload a ZIP archive with malicious PHP payloads. These payloads are extracted into a web-accessible media directory, enabling direct execution of arbitrary code on the server.

Successful exploitation allows unauthenticated remote attackers to execute arbitrary code on the affected server with the privileges of the web server user. This can lead to full system compromise, data theft, or further attacks within the network. The vulnerability has a CVSS 4.0 base score of 9.3, indicating critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

No patch or official fix is currently documented for this vulnerability. Users should check the vendor's advisory for updates and apply any forthcoming patches promptly. Until a fix is available, restrict access to the import.php functionality, implement web application firewall rules to block malicious uploads, and consider disabling the template import feature if not required. Monitor for suspicious activity related to file uploads and web-accessible media directories.