CVE-2026-41459 is an information disclosure vulnerability in thexerteproject's xerteonlinetoolkits affecting version 3.15 and earlier. Unauthenticated attackers can send a GET request to the /setup page to obtain the full server-side filesystem path of the application root, which is rendered in the HTML response. This exposure of sensitive system information (CWE-497) can aid attackers in exploiting further path-dependent vulnerabilities, including relative path traversal in connector.php. No official patch or remediation level has been published as of the data provided.

The vulnerability allows unauthenticated attackers to disclose sensitive system information, specifically the full server-side filesystem path of the application root. This information disclosure can facilitate further exploitation of path-dependent vulnerabilities such as relative path traversal, potentially leading to unauthorized file access or modification. However, there is no indication of direct remote code execution or privilege escalation solely from this vulnerability. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor thexerteproject's advisories for updates. Until a patch is available, restrict access to the /setup page if possible, and consider implementing web application firewall rules to block suspicious requests targeting this endpoint.