Missing Authentication Flaw in Xerte Online Toolkits from Xerte Project

CVE-2026-34413

What is CVE-2026-34413?

Xerte Online Toolkits versions 3.15 and earlier are susceptible to a missing authentication vulnerability in the elFinder connector endpoint located at /editor/elfinder/php/connector.php. This flaw allows unauthenticated attackers to execute HTTP redirects that do not terminate the request, leading to unauthorized access to file operations within project media directories. Attackers can manipulate the system to create, upload, rename, duplicate, and delete files, potentially chaining these actions with path traversal and extension blocklist weaknesses to gain remote code execution and read sensitive files.

References