EUVD-2026-25068
GHSA-qmm4-q4hj-r5cm
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulnCheck) · only source for this CVE.
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
6DescriptionCVE.org
Xerte Online Toolkits versions 3.15 and earlier contain a relative path traversal vulnerability in the elFinder connector endpoint at /editor/elfinder/php/connector.php where the name parameter in rename commands is not sanitized for path traversal sequences. Attackers can supply a name value containing directory traversal sequences to move files from project media directories to arbitrary locations on the filesystem, potentially overwriting application files, achieving stored cross-site scripting, or combining with other vulnerabilities to achieve unauthenticated remote code execution by moving PHP code files to the application root.
AnalysisAI
Path traversal in Xerte Online Toolkits' elFinder connector allows authenticated attackers to move files to arbitrary filesystem locations, enabling application file overwrites, stored XSS, or chained remote code execution. Affects versions 3.15 and earlier through unsanitized rename operations at /editor/elfinder/php/connector.php. Vendor patches available via GitHub commits 02661be, 507d55c, and 17e4f94. CVSS 7.1 with low attack complexity and low privileges required. No public exploitation confirmed (SSVC: exploitation=none), but attack is not automatable per CISA framework.
Technical ContextAI
The vulnerability resides in the elFinder file manager connector, a PHP-based file management component integrated into Xerte Online Toolkits for handling media assets in project directories. The connector's rename command handler fails to sanitize the 'name' parameter for directory traversal sequences (../, ../../, etc.), a classic CWE-22 path traversal weakness. When processing rename operations, the application constructs filesystem paths by concatenating user-supplied input without validation or canonicalization, allowing attackers to escape intended directory boundaries. The elFinder connector endpoint at /editor/elfinder/php/connector.php accepts POST requests with rename commands, where the 'name' parameter controls the destination filename. By injecting traversal sequences, authenticated users can relocate files from their sandboxed project media directories to arbitrary writable locations, including the application root. The CPE cpe:2.3:a:thexerteproject:xerteonlinetoolkits identifies all versions through 3.15.0 as vulnerable, with EUVD tracking specific affected versions 3.13.0, 3.14.0, and 3.15.0 plus pre-patch commits.
RemediationAI
Apply vendor patches immediately by upgrading to Xerte Online Toolkits version incorporating GitHub commits 02661be88cc369325ea01b508086bde7fbfec805, 507d55c5e91bf9310b5b1c7fad8aebfef902ad23, and 17e4f945fe6a3400fa88c01eda18c1075ee4a212, available from https://xerte.org.uk/index.php/en/downloads-1/category/3-xerte-online-toolkits. If immediate patching is not feasible, implement web application firewall (WAF) rules to block HTTP POST requests to /editor/elfinder/php/connector.php containing traversal sequences (../, ..\ , %2e%2e%2f, %252e%252e%252f) in the 'name' parameter-note this may interfere with legitimate rename operations using periods in filenames. Restrict filesystem write permissions for the web server user to prevent file moves outside designated media directories, though this may break intended application functionality for file management. Review user account privileges and disable unnecessary authenticated accounts to reduce attack surface, acknowledging operational impact on collaborative workflows. Monitor web server logs for POST requests to connector.php with suspicious 'name' parameter values as detection control. Full remediation details at VulnCheck advisory https://www.vulncheck.com/advisories/xerte-online-toolkits-path-traversal-via-connector-php.
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
NetAlertX (formerly PiAlert) versions 23.01.14 through 24.x before 24.10.12 allow unauthenticated command injection thro
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
Same weakness CWE-22 – Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today