CVE-2026-41459 is an information disclosure vulnerability in thexerteproject's xerteonlinetoolkits (version 3.15 and earlier) where unauthenticated attackers can access the full server-side filesystem path of the application root by requesting the /setup page. The disclosed root_path value is rendered in the HTML response, which may enable attackers to leverage path-dependent vulnerabilities such as relative path traversal in connector.php. The vulnerability is classified under CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere) and has a CVSS 4.0 score of 6.9 (medium severity). No vendor advisory or patch is currently available, and the product is not a cloud service.

The vulnerability allows unauthenticated attackers to obtain sensitive system information, specifically the full server-side filesystem path of the application root. This information disclosure can aid attackers in crafting further attacks that rely on knowledge of the filesystem structure, such as relative path traversal exploits. However, the vulnerability itself does not directly allow system compromise or data modification. There are no known active exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix is currently available, users should monitor thexerteproject's official channels for updates. Until a fix is released, consider restricting access to the /setup page or implementing web application firewall rules to block unauthorized requests to this endpoint.