A critical remote code execution vulnerability in Lutece Core, affecting versions prior to 7.1.7, poses a severe risk of full system compromise by authenticated administrators.

The application fails to enable secure processing mode (FEATURE_SECURE_PROCESSING) within its XML/XSLT export module, permitting the execution of Java extension functions from uploaded XSL files. This flaw allows an authenticated administrator to inject and trigger arbitrary code execution during user export operations.

The vulnerability carries a CVSS score of 9.4, reflecting the potential for total system compromise. Successful exploitation grants an attacker full control over the server, leading to unauthorized data exfiltration, permanent loss of system integrity, and significant operational downtime. Such an event would likely result in severe reputational damage and regulatory noncompliance.

Immediate Action: Update Lutece Core to version 7.1.9 or later as recommended by the vendor to remediate the unsafe XSLT processing configuration.

Proactive Monitoring: Review application and system access logs for any irregular file uploads or unusual activity originating from administrative user accounts.

Compensating Controls: Implement strict file validation policies and restrict the ability to upload or execute XSL files to the absolute minimum number of trusted administrators.

Public Exploit Available: Unknown

Given the critical nature of this vulnerability and the potential for full server takeover, administrators must prioritize the update to version 7.1.9 immediately. Failure to patch allows any compromised or malicious administrative account to execute arbitrary code, creating a significant and unacceptable security risk to the entire environment.