CVE-2026-34414 json
Xerte Online Toolkits Path Traversal via connector.php
published 2026-04-22 6 mo ago modified 2026-10-26 13 d ago also EUVD-2026-25068
- cvss
- 7.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 2.8%
- EPSS 2.8% chance of exploitation in 30 days, percentile 86%
- public exploits
- 1
- Metasploit
Summary
Xerte Online Toolkits versions 3.15 and earlier contain a relative path traversal vulnerability in the elFinder connector endpoint at /editor/elfinder/php/connector.php where the name parameter in rename commands is not sanitized for path traversal sequences. Attackers can supply a name value containing directory traversal sequences to move files from project media directories to arbitrary locations on the filesystem, potentially overwriting application files, achieving stored cross-site scripting, or combining with other vulnerabilities to achieve unauthenticated remote code execution by moving PHP code files to the application root.
Patch / fix
- apereo xerte_online_toolkits 3.15.5
Timeline
- First public exploit (Metasploit exploit/multi/http/xerte_unauthenticated_mediaupload)
- Published
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 6 mo ago
Exploit prediction
2.83% chance of exploitation in the next 30 days, higher than 86% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Metasploit exploit/multi/http/xerte_unauthenticated_mediaupload Xerte Online Toolkits Arbitrary File Upload - Unauthenticated Media Upload metasploit exploit, excellent rank, 2026-04-22
- github.com https://github.com/bootstrapbool/xerteonlinetoolkits-rce referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 7.1 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N |
| CNA | 3.1 | 7.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N |
| CNA | 4.0 | 7.1 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected products
- thexerteproject xerteonlinetoolkits
Classification
- Weakness
-
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory
References
-
github.com
/thexerteproject/xerteonlinetoolkits/commit/02661be88cc369325ea01b508086bde7fbfec805
patch
-
github.com
/thexerteproject/xerteonlinetoolkits/commit/17e4f945fe6a3400fa88c01eda18c1075ee4a212
patch
-
github.com
/thexerteproject/xerteonlinetoolkits/commit/507d55c5e91bf9310b5b1c7fad8aebfef902ad23
patch
-
github.com
/bootstrapbool/xerteonlinetoolkits-rce
technical-description, exploit
-
xerte.org.uk
/xertetoolkits_3.15_ChangeLog.html
release-notes
-
xerte.org.uk
/index.php/en/downloads-1/category/3-xerte-online-toolkits
product, permissions-required
-
github.com
/thexerteproject/xerteonlinetoolkits/issues/1527
issue-tracking
-
vulncheck.com
/advisories/xerte-online-toolkits-path-traversal-via-connector-php
third-party-advisory
Sources
- CVE List CVE-2026-34414
- NVD CVE-2026-34414
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.