Junglewise Threat Intelligence

CVE-2026-34413: The Xerte Project Xerte Online Toolkits auth bypass in elFinder connector

CVE-2026-34413 · Severity: high · CVSS 8.6 · Published 2026-04-22

Technologies: The Xerte Project Xerte Online Toolkits. Vendors: The Xerte Project.

Executive brief

Xerte Online Toolkits, an open-source platform for creating interactive learning materials, contains a security flaw in its file management component. This vulnerability allows an unauthenticated attacker to bypass login requirements and perform unauthorized file operations, such as uploading, deleting, or renaming files. If exploited, an attacker could gain full control over the server, potentially leading to data theft or a complete service shutdown.

Technical details

A missing authentication vulnerability exists in Xerte Online Toolkits versions 3.15 and earlier within the elFinder connector endpoint at /editor/elfinder/php/connector.php. The application attempts to redirect unauthenticated users using an HTTP header but fails to call exit() or die(), allowing the PHP script to continue executing the request server-side. An unauthenticated attacker can exploit this to perform arbitrary file operations (upload, delete, rename) in project media directories. This can be further chained with path traversal (CVE-2026-34414) and extension blocklist bypasses (CVE-2026-34415) to achieve remote code execution. Patches have been backported to versions 3.13, 3.14, and 3.15.

Affected products

  • The Xerte Project Xerte Online Toolkits <= 3.15

Timeline

  • 2026-03-23: disclosed: Vulnerability reported to the vendor via GitHub issues.
  • 2026-04-22: advisory: CVE-2026-34413 published.
  • 2026-04-22: patched: Fixes committed to the main repository.

References

Related threats