A Remote Code Exection vulnerability exists in Xerte through 3.9 by uploading a maliciously crafted PHP file though the project interface disguised as a language file to bypasses the upload filters. Attackers can manipulate the files destination by abusing path traversal in the vulnerable variable.
