Xerte Online Toolkits CVE-2026-34414

Requires authenticated access with low privileges (PR:L in CVSS vector) to Xerte Online Toolkits, specifically user accounts with permission to create projects and upload files to project media directories. Exploitation targets installations using vulnerable elFinder connector versions at /editor/elfinder/php/connector.php endpoint where the rename command handler processes user-supplied 'name' parameters. The application must have filesystem write permissions allowing file moves from project directories to target locations (typically application root or other web-accessible directories). Attack succeeds against default configurations of Xerte Online Toolkits 3.13.0 through 3.15.0 with network-accessible installations (AV:N). Limiting factors: authentication barrier prevents unauthenticated mass exploitation, and successful RCE chaining requires writable application root directories and knowledge of target filesystem structure. Organizations restricting user account creation or implementing strict filesystem permissions reduce exploitability despite network exposure.

The CVSS 7.1 score reflects high integrity impact (VI:H) with network attack vector (AV:N), low complexity (AC:L), and low privileges required (PR:L), indicating straightforward exploitation by any authenticated user. However, real-world risk assessment reveals nuanced factors: SSVC framework marks exploitation as 'none' and automatable as 'no', suggesting this requires authenticated access and manual interaction rather than mass-scanning exploitation. The technical impact is rated 'partial' by SSVC, aligning with CVSS confidentiality impact of low (VC:L). The vulnerability's severity stems from its chaining potential-moving PHP files to web-accessible directories converts path traversal into RCE, and relocating HTML/JavaScript enables persistent XSS. VulnCheck's advisory and three distinct GitHub patch commits (02661be, 507d55c, 17e4f94) confirm vendor acknowledgment and remediation. No CISA KEV listing and SSVC exploitation status 'none' indicate no confirmed active exploitation at time of analysis. Priority should be HIGH for internet-facing instances with multiple authenticated users, MEDIUM for internal deployments with trusted user bases. The authentication requirement (PR:L) significantly reduces attack surface compared to unauthenticated path traversals, but the low complexity and network vector make this exploitable by any malicious insider or compromised account.

An authenticated attacker with low-privilege access to Xerte Online Toolkits creates a learning project and uploads a malicious PHP shell to their project media directory (legitimate functionality). They intercept the rename request to /editor/elfinder/php/connector.php and modify the 'name' parameter to '../../../index.php' or '../../../shell.php', moving their uploaded file from the sandboxed media directory to the application root. Upon successful traversal, the attacker accesses the relocated PHP file via direct HTTP request (e.g., https://target.example.com/shell.php), achieving remote code execution with web server privileges. No public proof-of-concept code identified at time of analysis, but the attack technique is well-documented for elFinder path traversal vulnerabilities.