CVE-2026-34413 json
Xerte Online Toolkits Missing Authentication via connector.php
published 2026-04-22 6 mo ago modified 2026-10-26 13 d ago also EUVD-2026-25067
- cvss
- 8.6
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 3.1%
- EPSS 3.1% chance of exploitation in 30 days, percentile 87%
- public exploits
- 1
- Metasploit, plus a Nuclei check
Summary
Xerte Online Toolkits versions 3.15 and earlier contain a missing authentication vulnerability in the elFinder connector endpoint at /editor/elfinder/php/connector.php where an HTTP redirect to unauthenticated callers does not call exit() or die(), allowing PHP execution to continue and process the full request server-side. Unauthenticated attackers can perform file operations on project media directories including creating directories, uploading files, renaming files, duplicating files, overwriting files, and deleting files, which can be chained with path traversal and extension blocklist vulnerabilities to achieve remote code execution and arbitrary file read.
Patch / fix
- apereo xerte_online_toolkits 3.15.5
Timeline
- First public exploit (Metasploit exploit/multi/http/xerte_unauthenticated_mediaupload)
- Published
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 6 mo ago
Exploit prediction
3.11% chance of exploitation in the next 30 days, higher than 87% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Metasploit exploit/multi/http/xerte_unauthenticated_mediaupload Xerte Online Toolkits Arbitrary File Upload - Unauthenticated Media Upload metasploit exploit, excellent rank, 2026-04-22
- Nuclei template Xerte Online Toolkits <= 3.15 - Remote Code Execution nuclei detection template
- github.com https://github.com/bootstrapbool/xerteonlinetoolkits-rce referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 8.8 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N |
| CNA | 3.1 | 8.6 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L |
| CNA | 4.0 | 8.8 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected products
- thexerteproject xerteonlinetoolkits
Classification
- Weakness
-
- CWE-497 Exposure of Sensitive System Information to an Unauthorized Control Sphere
References
-
github.com
/thexerteproject/xerteonlinetoolkits/commit/02661be88cc369325ea01b508086bde7fbfec805
patch
-
github.com
/thexerteproject/xerteonlinetoolkits/commit/17e4f945fe6a3400fa88c01eda18c1075ee4a212
patch
-
github.com
/thexerteproject/xerteonlinetoolkits/commit/507d55c5e91bf9310b5b1c7fad8aebfef902ad23
patch
-
github.com
/bootstrapbool/xerteonlinetoolkits-rce
technical-description, exploit
-
xerte.org.uk
/xertetoolkits_3.15_ChangeLog.html
release-notes
-
xerte.org.uk
/index.php/en/downloads-1/category/3-xerte-online-toolkits
product, permissions-required
-
github.com
/thexerteproject/xerteonlinetoolkits/issues/1527
issue-tracking
-
vulncheck.com
/advisories/xerte-online-toolkits-missing-authentication-via-connector-php
third-party-advisory
Sources
- CVE List CVE-2026-34413
- NVD CVE-2026-34413
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.