Executive brief
Xerte Online Toolkits, an open-source platform for creating interactive learning materials, contains a security flaw in its file management component. An attacker can bypass security checks to upload and execute malicious code on the server. This could allow a remote attacker to take full control of the system, potentially leading to data theft or a complete service outage.
Technical details
Xerte Online Toolkits (<= 3.15) contains an incomplete list of disallowed inputs (CWE-184) in the elFinder connector endpoint (/editor/elfinder/php/connector.php). The regex pattern used to filter file extensions incorrectly allows files with the .php4 extension to be processed. By chaining this with an authentication bypass (CVE-2026-34413) and a path traversal vulnerability (CVE-2026-34414), an unauthenticated remote attacker can upload a malicious file, rename it to use a .php4 extension, and move it to the application root to achieve arbitrary code execution. Patches have been backported to versions 3.13, 3.14, and 3.15.
Affected products
- The Xerte Project Xerte Online Toolkits <= 3.15
Timeline
- 2026-03-23: disclosed: Vulnerability reported to developers via GitHub issue
- 2026-04-22: advisory: NVD publication date
References
- https://github.com/bootstrapbool/xerteonlinetoolkits-rce
- https://github.com/thexerteproject/xerteonlinetoolkits/commit/02661be88cc369325ea01b508086bde7fbfec805
- https://github.com/thexerteproject/xerteonlinetoolkits/commit/17e4f945fe6a3400fa88c01eda18c1075ee4a212
- https://github.com/thexerteproject/xerteonlinetoolkits/commit/507d55c5e91bf9310b5b1c7fad8aebfef902ad23
- https://github.com/thexerteproject/xerteonlinetoolkits/issues/1527
- https://www.vulncheck.com/advisories/xerte-online-toolkits-file-upload-rce-via-elfinder-connector
- https://xerte.org.uk/index.php/en/downloads-1/category/3-xerte-online-toolkits