CVE-2026-4813: CWE-94 in Lutece Lutece Core

This vulnerability in Lutece Core's XSL export management module (up to version 7.1.7) stems from the lack of secure processing mode (FEATURE_SECURE_PROCESSING) in XML/XSLT handling. Authenticated administrators can upload manipulated XSL transformation files containing Java extension functions, which are executed during export operations, leading to remote code execution on the server. The CVSS 4.0 score is 9.4, indicating a critical severity with network attack vector, low attack complexity, no user interaction, and high impacts on confidentiality, integrity, availability, and security requirements.

An attacker with administrator privileges can achieve remote code execution on the server by uploading and triggering malicious XSL transformation files. This compromises the confidentiality, integrity, and availability of the affected system, potentially allowing full control over the server environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrator access to trusted personnel only and monitor for suspicious activity related to XSL file uploads and export operations.