# CVE-2026-34414: The Xerte Project Xerte Online Toolkits path traversal in elFinder connector

Source: https://junglewise.ai/threats/cve-2026-34414-the-xerte-project-xerte-online-toolkits-path-traversal-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-22. Updated: 2026-07-14  
License: CC BY 4.0 with a link back

CVE-2026-34414 · Severity: high · CVSS 7.1 · Published 2026-04-22

Xerte Online Toolkits, an open-source platform for creating interactive learning materials, is vulnerable to a security flaw in its file management component. An attacker can exploit this to move files to unauthorized locations on the server, potentially leading to the theft of sensitive data or a complete takeover of the application. While the attack typically requires a valid username, it can be combined with other flaws to allow unauthorized users to execute malicious code on the system.

Technologies: [The Xerte Project Xerte Online Toolkits](https://junglewise.ai/threats/technologies/xerte-online-toolkits). Vendors: [The Xerte Project](https://junglewise.ai/threats/vendors/the-xerte-project).

## Quick answers

**Is CVE-2026-34414 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-34414 being exploited in the wild.

**How severe is CVE-2026-34414?** High severity, with a CVSS score of 7.1, published 22 April 2026.

**Which products and versions are affected?** The Xerte Project Xerte Online Toolkits <= 3.15.

**Is there a fix for CVE-2026-34414?** A patch was published on 2026-04-22: Fixes committed to GitHub repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-34414 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-34414?** Check whether you run The Xerte Project Xerte Online Toolkits at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A relative path traversal vulnerability exists in Xerte Online Toolkits (<= 3.15) within the elFinder connector endpoint located at /editor/elfinder/php/connector.php. The root cause is a failure to sanitize the 'name' parameter during 'rename' commands. An attacker with network access and a valid username (or by chaining with CVE-2026-34413 for unauthenticated access) can supply traversal sequences (e.g., ../) to move files from project media directories to the application root. When combined with incomplete file extension filtering (CVE-2026-34415), this allows an attacker to upload and move a malicious PHP file to the web root to achieve remote code execution. Patches have been backported to versions 3.13, 3.14, and 3.15.

## Affected products

- The Xerte Project Xerte Online Toolkits <= 3.15

## Timeline

- 2026-03-23: disclosed: Vulnerability reported to developers via GitHub issue
- 2026-04-22: advisory: CVE published by VulnCheck
- 2026-04-22: patched: Fixes committed to GitHub repository

## References

- [https://github.com/bootstrapbool/xerteonlinetoolkits-rce](https://github.com/bootstrapbool/xerteonlinetoolkits-rce)
- [https://github.com/thexerteproject/xerteonlinetoolkits/commit/02661be88cc369325ea01b508086bde7fbfec805](https://github.com/thexerteproject/xerteonlinetoolkits/commit/02661be88cc369325ea01b508086bde7fbfec805)
- [https://github.com/thexerteproject/xerteonlinetoolkits/commit/17e4f945fe6a3400fa88c01eda18c1075ee4a212](https://github.com/thexerteproject/xerteonlinetoolkits/commit/17e4f945fe6a3400fa88c01eda18c1075ee4a212)
- [https://github.com/thexerteproject/xerteonlinetoolkits/commit/507d55c5e91bf9310b5b1c7fad8aebfef902ad23](https://github.com/thexerteproject/xerteonlinetoolkits/commit/507d55c5e91bf9310b5b1c7fad8aebfef902ad23)
- [https://github.com/thexerteproject/xerteonlinetoolkits/issues/1527](https://github.com/thexerteproject/xerteonlinetoolkits/issues/1527)
- [https://www.vulncheck.com/advisories/xerte-online-toolkits-path-traversal-via-connector-php](https://www.vulncheck.com/advisories/xerte-online-toolkits-path-traversal-via-connector-php)
- [https://xerte.org.uk/index.php/en/downloads-1/category/3-xerte-online-toolkits](https://xerte.org.uk/index.php/en/downloads-1/category/3-xerte-online-toolkits)

## Related threats

- [The Xerte Project Xerte Online Toolkits RCE via antivirus binary path configuration](https://junglewise.ai/threats/cve-2026-12116-the-xerte-project-xerte-online-toolkits-rce-via-antivirus-binary)
- [thexerteproject Xerte Online Toolkits path disclosure in setup page](https://junglewise.ai/threats/cve-2026-41459-thexerteproject-xerte-online-toolkits-path-disclosure-in-setup)
- [The Xerte Project Xerte Online Toolkits RCE in elFinder connector](https://junglewise.ai/threats/cve-2026-34415-the-xerte-project-xerte-online-toolkits-rce-in-elfinder-connector)
- [The Xerte Project Xerte Online Toolkits auth bypass in elFinder connector](https://junglewise.ai/threats/cve-2026-34413-the-xerte-project-xerte-online-toolkits-auth-bypass-in-elfinder)