Junglewise Threat Intelligence

CVE-2026-34414: The Xerte Project Xerte Online Toolkits path traversal in elFinder connector

CVE-2026-34414 · Severity: high · CVSS 7.1 · Published 2026-04-22

Technologies: The Xerte Project Xerte Online Toolkits. Vendors: The Xerte Project.

Executive brief

Xerte Online Toolkits, an open-source platform for creating interactive learning materials, is vulnerable to a security flaw in its file management component. An attacker can exploit this to move files to unauthorized locations on the server, potentially leading to the theft of sensitive data or a complete takeover of the application. While the attack typically requires a valid username, it can be combined with other flaws to allow unauthorized users to execute malicious code on the system.

Technical details

A relative path traversal vulnerability exists in Xerte Online Toolkits (<= 3.15) within the elFinder connector endpoint located at /editor/elfinder/php/connector.php. The root cause is a failure to sanitize the 'name' parameter during 'rename' commands. An attacker with network access and a valid username (or by chaining with CVE-2026-34413 for unauthenticated access) can supply traversal sequences (e.g., ../) to move files from project media directories to the application root. When combined with incomplete file extension filtering (CVE-2026-34415), this allows an attacker to upload and move a malicious PHP file to the web root to achieve remote code execution. Patches have been backported to versions 3.13, 3.14, and 3.15.

Affected products

  • The Xerte Project Xerte Online Toolkits <= 3.15

Timeline

  • 2026-03-23: disclosed: Vulnerability reported to developers via GitHub issue
  • 2026-04-22: advisory: CVE published by VulnCheck
  • 2026-04-22: patched: Fixes committed to GitHub repository

References

Related threats