Xerte Online Toolkits CVE-2026-34413

Exploitation requires only network access to an internet-facing or network-accessible Xerte Online Toolkits installation running versions 3.15 or earlier with the elFinder connector endpoint (/editor/elfinder/php/connector.php) reachable by the attacker. No authentication, user interaction, or special configuration is required per the CVSS:4.0 vector (PR:N/UI:N/AT:N). The vulnerability exists in default installations and configurations. Full remote code execution requires chaining with path traversal capabilities to escape the project media directory sandbox and extension blocklist bypasses to upload executable PHP files, but these are described as complementary vulnerabilities in the same codebase. Without these chaining vulnerabilities, attackers are limited to file operations within the project media directories, which still enables denial of service via file deletion and potential information disclosure via file duplication and exfiltration. Organizations that have deployed Xerte behind authentication proxies or restricted network segments face reduced risk, but the application-level authentication bypass means network-level controls are the only effective barrier pre-patch.

This vulnerability represents critical real-world risk despite the 8.8 CVSS score understating its severity. The CVSS:4.0 vector shows network attack vector with low complexity (AC:L), no privileges required (PR:N), and no user interaction (UI:N), making it trivially exploitable by unauthenticated remote attackers. The vulnerability impact (VC:L/VI:H/VA:L) reflects confidentiality, integrity, and availability damage, but critically understates the remote code execution potential when chained with complementary vulnerabilities. VulnCheck's identification and detailed advisory with three separate patch commits (507d55c, 17e4f94, 02661be) confirms vendor acknowledgment and remediation. No EPSS score is provided, and CISA KEV status is absent, suggesting no confirmed widespread exploitation at analysis time, though the authentication bypass nature and RCE potential make this a high-priority target for vulnerability scanning and opportunistic attacks. The existence of three separate commits to address the issue across different code paths suggests complexity in the fix and potential for incomplete remediation in earlier patch attempts. Organizations running Xerte Online Toolkits in internet-facing deployments face immediate risk of unauthorized access and system compromise.

An unauthenticated remote attacker sends HTTP POST requests to https://target.edu/editor/elfinder/php/connector.php with elFinder API commands, bypassing authentication due to the missing exit() call after redirect. The attacker first uses 'cmd=mkdir' to create a new directory in the project media path, then 'cmd=upload' to place a PHP web shell file, potentially using path traversal sequences (../) to escape media directory restrictions and extension blocklist bypasses to overcome .php file restrictions. Once the web shell is uploaded and accessible via the web server, the attacker executes arbitrary system commands, escalates privileges, installs persistence mechanisms, and exfiltrates sensitive data from the Xerte installation and underlying server. Public exploit code status is not confirmed from available data, but the straightforward nature of the authentication bypass and VulnCheck's detailed advisory make proof-of-concept development trivial for skilled attackers.