CVE-2026-34413: The Xerte Project Xerte Online Toolkits auth bypass in elFinder connector

CVE-2026-34413 · Severity: high · CVSS 8.6 · Published 2026-04-22

Xerte Online Toolkits, an open-source platform for creating interactive learning materials, contains a security flaw in its file management component. This vulnerability allows an unauthenticated attacker to bypass login requirements and perform unauthorized file operations, such as uploading, deleting, or renaming files. If exploited, an attacker could gain full control over the server, potentially leading to data theft or a complete service shutdown.

Technologies: The Xerte Project Xerte Online Toolkits. Vendors: The Xerte Project.

Quick answers

Is CVE-2026-34413 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-34413 being exploited in the wild.
How severe is CVE-2026-34413?
High severity, with a CVSS score of 8.6, published 22 April 2026.
Which products and versions are affected?
The Xerte Project Xerte Online Toolkits <= 3.15.
Is there a fix for CVE-2026-34413?
A patch was published on 2026-04-22: Fixes committed to the main repository. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-34413 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-34413?
Check whether you run The Xerte Project Xerte Online Toolkits at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A missing authentication vulnerability exists in Xerte Online Toolkits versions 3.15 and earlier within the elFinder connector endpoint at /editor/elfinder/php/connector.php. The application attempts to redirect unauthenticated users using an HTTP header but fails to call exit() or die(), allowing the PHP script to continue executing the request server-side. An unauthenticated attacker can exploit this to perform arbitrary file operations (upload, delete, rename) in project media directories. This can be further chained with path traversal (CVE-2026-34414) and extension blocklist bypasses (CVE-2026-34415) to achieve remote code execution. Patches have been backported to versions 3.13, 3.14, and 3.15.

Affected products

  • The Xerte Project Xerte Online Toolkits <= 3.15

Timeline

  • 2026-03-23: disclosed: Vulnerability reported to the vendor via GitHub issues.
  • 2026-04-22: advisory: CVE-2026-34413 published.
  • 2026-04-22: patched: Fixes committed to the main repository.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.