CVE-2026-34414

Xerte Online Toolkits Path Traversal via connector.php

State: Published
Severity: 7.1 High
Published: Apr 22, 2026
Updated: Jul 14, 2026
Reserved: Mar 27, 2026

Description

Xerte Online Toolkits versions 3.15 and earlier contain a relative path traversal vulnerability in the elFinder connector endpoint at /editor/elfinder/php/connector.php where the name parameter in rename commands is not sanitized for path traversal sequences. Attackers can supply a name value containing directory traversal sequences to move files from project media directories to arbitrary locations on the filesystem, potentially overwriting application files, achieving stored cross-site scripting, or combining with other vulnerabilities to achieve unauthenticated remote code execution by moving PHP code files to the application root.

Scores

CVSS	Score	Vector	Source
4.0	7.1 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N	VulnCheck
3.1	7.1 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N	VulnCheck

Weaknesses

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Affected Products

Product	Versions
xerteonlinetoolkitsthexerteproject	3.15.0 and earlierAffected

References

https://github.com/bootstrapbool/xerteonlinetoolkits-rcetechnical-descriptionexploit
https://xerte.org.uk/xertetoolkits_3.15_ChangeLog.htmlrelease-notes
https://xerte.org.uk/index.php/en/downloads-1/category/3-xerte-online-toolkitsproductpermissions-required
https://github.com/thexerteproject/xerteonlinetoolkits/issues/1527issue-tracking
https://github.com/thexerteproject/xerteonlinetoolkits/commit/02661be88cc369325ea01b508086bde7fbfec805patch
https://github.com/thexerteproject/xerteonlinetoolkits/commit/17e4f945fe6a3400fa88c01eda18c1075ee4a212patch
https://github.com/thexerteproject/xerteonlinetoolkits/commit/507d55c5e91bf9310b5b1c7fad8aebfef902ad23patch
https://www.vulncheck.com/advisories/xerte-online-toolkits-path-traversal-via-connector-phpthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.