CVE-2026-34414: The Xerte Project Xerte Online Toolkits path traversal in elFinder connector

CVE-2026-34414 · Severity: high · CVSS 7.1 · Published 2026-04-22

Xerte Online Toolkits, an open-source platform for creating interactive learning materials, is vulnerable to a security flaw in its file management component. An attacker can exploit this to move files to unauthorized locations on the server, potentially leading to the theft of sensitive data or a complete takeover of the application. While the attack typically requires a valid username, it can be combined with other flaws to allow unauthorized users to execute malicious code on the system.

Technologies: The Xerte Project Xerte Online Toolkits. Vendors: The Xerte Project.

Quick answers

Is CVE-2026-34414 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-34414 being exploited in the wild.
How severe is CVE-2026-34414?
High severity, with a CVSS score of 7.1, published 22 April 2026.
Which products and versions are affected?
The Xerte Project Xerte Online Toolkits <= 3.15.
Is there a fix for CVE-2026-34414?
A patch was published on 2026-04-22: Fixes committed to GitHub repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-34414 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-34414?
Check whether you run The Xerte Project Xerte Online Toolkits at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A relative path traversal vulnerability exists in Xerte Online Toolkits (<= 3.15) within the elFinder connector endpoint located at /editor/elfinder/php/connector.php. The root cause is a failure to sanitize the 'name' parameter during 'rename' commands. An attacker with network access and a valid username (or by chaining with CVE-2026-34413 for unauthenticated access) can supply traversal sequences (e.g., ../) to move files from project media directories to the application root. When combined with incomplete file extension filtering (CVE-2026-34415), this allows an attacker to upload and move a malicious PHP file to the web root to achieve remote code execution. Patches have been backported to versions 3.13, 3.14, and 3.15.

Affected products

  • The Xerte Project Xerte Online Toolkits <= 3.15

Timeline

  • 2026-03-23: disclosed: Vulnerability reported to developers via GitHub issue
  • 2026-04-22: advisory: CVE published by VulnCheck
  • 2026-04-22: patched: Fixes committed to GitHub repository

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.