EUVD-2026-25067
GHSA-g35c-vgp7-f8qm
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulnCheck) · only source for this CVE.
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
7DescriptionCVE.org
Xerte Online Toolkits versions 3.15 and earlier contain a missing authentication vulnerability in the elFinder connector endpoint at /editor/elfinder/php/connector.php where an HTTP redirect to unauthenticated callers does not call exit() or die(), allowing PHP execution to continue and process the full request server-side. Unauthenticated attackers can perform file operations on project media directories including creating directories, uploading files, renaming files, duplicating files, overwriting files, and deleting files, which can be chained with path traversal and extension blocklist vulnerabilities to achieve remote code execution and arbitrary file read.
AnalysisAI
Unauthenticated attackers can execute remote code and read arbitrary files in Xerte Online Toolkits 3.15 and earlier via a missing authentication flaw in the elFinder connector endpoint. The vulnerability stems from a logic error where HTTP redirects for unauthenticated requests fail to terminate PHP execution, allowing full server-side processing of file operations. Attackers can create directories, upload files, rename, duplicate, overwrite, and delete files in project media directories without authentication. When chained with path traversal and extension blocklist bypasses, this enables complete system compromise. VulnCheck identified the flaw, and vendor patches are available via three GitHub commits addressing versions 3.13.0 through 3.15.0.
Technical ContextAI
The vulnerability affects the elFinder PHP file manager connector integrated into Xerte Online Toolkits at the endpoint /editor/elfinder/php/connector.php. ElFinder is a web-based file manager library commonly used in content management systems. The flaw is rooted in CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere), though the specific manifestation is an authentication bypass logic error. When the connector receives unauthenticated requests, it issues an HTTP redirect response but fails to call PHP's exit() or die() functions afterward. This allows the PHP interpreter to continue executing the request handler, processing elFinder commands server-side despite the authentication check failure. The CVSS:4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms network-accessible exploitation with no complexity barriers, no attack requirements, and no privileges or user interaction needed. Affected products identified via CPE include cpe:2.3:a:thexerteproject:xerteonlinetoolkits versions 3.13.0, 3.14.0, and 3.15.0, as well as commits prior to three specific patches in the GitHub repository.
RemediationAI
Apply vendor patches immediately by upgrading to Xerte Online Toolkits version 3.16 or later from https://xerte.org.uk/index.php/en/downloads-1/category/3-xerte-online-toolkits, or manually apply the three security commits from GitHub: 507d55c5e91bf9310b5b1c7fad8aebfef902ad23, 17e4f945fe6a3400fa88c01eda18c1075ee4a212, and 02661be88cc369325ea01b508086bde7fbfec805 (commit URLs available at https://github.com/thexerteproject/xerteonlinetoolkits repository). For environments unable to immediately patch, implement compensating controls by restricting network access to the /editor/elfinder/php/connector.php endpoint using web application firewall rules or web server access controls to permit only authenticated internal users, though this introduces operational complexity in multi-tenant or remote learning environments. Alternatively, disable the elFinder connector entirely if file management functionality is not business-critical, though this breaks media upload and management features in the Xerte editor interface. Review web server access logs for suspicious POST requests to /editor/elfinder/php/connector.php from unauthenticated sources, particularly those containing elFinder command parameters like 'cmd=upload', 'cmd=mkdir', or 'cmd=rename', as indicators of potential exploitation attempts or successful compromise.
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
NetAlertX (formerly PiAlert) versions 23.01.14 through 24.x before 24.10.12 allow unauthenticated command injection thro
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
Same technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today