Skip to main content

Xerte Online Toolkits CVE-2026-34413

| EUVD-2026-25067 HIGH
Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497)
2026-04-22 VulnCheck GHSA-g35c-vgp7-f8qm
PHP Path Traversal Authentication Bypass RCE
8.8
CVSS 4.0 · NVD
Share

Severity by source

NVD PRIMARY
8.8 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

7
Re-analysis Queued
Apr 24, 2026 - 20:22 vuln.today
cvss_changed
Analysis Generated
Apr 23, 2026 - 06:58 vuln.today
CVSS changed
Apr 22, 2026 - 19:22 NVD
8.6 (HIGH) 8.8 (HIGH)
EUVD ID Assigned
Apr 22, 2026 - 19:01 euvd
EUVD-2026-25067
Analysis Generated
Apr 22, 2026 - 19:01 vuln.today
Patch released
Apr 22, 2026 - 19:01 nvd
Patch available
CVE Published
Apr 22, 2026 - 18:33 nvd
HIGH 8.8

DescriptionCVE.org

Xerte Online Toolkits versions 3.15 and earlier contain a missing authentication vulnerability in the elFinder connector endpoint at /editor/elfinder/php/connector.php where an HTTP redirect to unauthenticated callers does not call exit() or die(), allowing PHP execution to continue and process the full request server-side. Unauthenticated attackers can perform file operations on project media directories including creating directories, uploading files, renaming files, duplicating files, overwriting files, and deleting files, which can be chained with path traversal and extension blocklist vulnerabilities to achieve remote code execution and arbitrary file read.

AnalysisAI

Unauthenticated attackers can execute remote code and read arbitrary files in Xerte Online Toolkits 3.15 and earlier via a missing authentication flaw in the elFinder connector endpoint. The vulnerability stems from a logic error where HTTP redirects for unauthenticated requests fail to terminate PHP execution, allowing full server-side processing of file operations. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Access vulnerable /editor/elfinder/php/connector.php endpoint
Delivery
Exploit authentication bypass via missing exit()
Exploit
Upload PHP web shell using elFinder commands
Execution
Traverse path restrictions to web-accessible directory
Persist
Execute arbitrary code as web server user
Impact
Establish persistent backdoor access
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires only network access to an internet-facing or network-accessible Xerte Online Toolkits installation running versions 3.15 or earlier with the elFinder connector endpoint (/editor/elfinder/php/connector.php) reachable by the attacker. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment This vulnerability represents critical real-world risk despite the 8.8 CVSS score understating its severity. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An unauthenticated remote attacker sends HTTP POST requests to https://target.edu/editor/elfinder/php/connector.php with elFinder API commands, bypassing authentication due to the missing exit() call after redirect. The attacker first uses 'cmd=mkdir' to create a new directory in the project media path, then 'cmd=upload' to place a PHP web shell file, potentially using path traversal sequences (../) to escape media directory restrictions and extension blocklist bypasses to overcome .php file restrictions. …
Remediation Apply vendor patches immediately by upgrading to Xerte Online Toolkits version 3.16 or later from https://xerte.org.uk/index.php/en/downloads-1/category/3-xerte-online-toolkits, or manually apply the three security commits from GitHub: 507d55c5e91bf9310b5b1c7fad8aebfef902ad23, 17e4f945fe6a3400fa88c01eda18c1075ee4a212, and 02661be88cc369325ea01b508086bde7fbfec805 (commit URLs available at https://github.com/thexerteproject/xerteonlinetoolkits repository). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: Identify all Xerte Online Toolkits instances and confirm versions ≤3.15.0; isolate affected servers from internet access if patching cannot occur immediately. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More from same product – last 7 days

CVE-2026-49952 CRITICAL POC
9.3 Jun 15

Authentication bypass in Discuz! X5.0 releases 20260320 through 20260501 allows unauthenticated remote attackers to acce
CVE-2026-49954 HIGH POC
8.6 Jun 15

Authenticated remote code execution in Discuz! X5.0 releases 20260320 through 20260501 allows administrators to chain a

CVE-2026-49768 CRITICAL
9.8 Jun 15

Unauthenticated PHP Object Injection in the Happyforms WordPress plugin (versions <= 1.26.13) allows remote attackers to
CVE-2026-27053 CRITICAL
9.8 Jun 15

Unauthenticated PHP Object Injection in the Broadcast Live Video WordPress plugin (versions prior to 7.1.3) allows remot
CVE-2026-49104 CRITICAL
9.8 Jun 15

Unauthenticated PHP object injection in the WordPress plugin 'Integration for Keap/Infusionsoft and Contact Form 7, WPFo

Share

CVE-2026-34413 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy