CVE-2026-41459 is an information disclosure vulnerability in thexerteproject's xerteonlinetoolkits (version 3.15 and earlier) where unauthenticated attackers can retrieve the full server-side filesystem path of the application root. This is achieved by sending a GET request to the /setup page, which returns the root_path value in the HTML response. Disclosure of this sensitive system information can aid attackers in exploiting other path-dependent vulnerabilities such as relative path traversal in connector.php. The vulnerability is classified under CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere).

The vulnerability allows unauthenticated attackers to obtain sensitive system information (the full server-side filesystem path of the application root). This information disclosure can facilitate further attacks, including exploitation of relative path traversal vulnerabilities. However, there is no direct evidence of remote code execution or data modification solely from this vulnerability. The CVSS 4.0 score of 6.9 reflects a medium severity impact due to the information disclosure and potential for subsequent exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the /setup page to trusted users or internal networks if possible. Monitor for updates from thexerteproject regarding patches or official mitigations. Avoid exposing the application to untrusted networks without additional access controls.