Path Traversal Vulnerability in Xerte Online Toolkits by Xerte Project

CVE-2026-34414

What is CVE-2026-34414?

Xerte Online Toolkits versions 3.15 and earlier are affected by a path traversal vulnerability in the elFinder connector, specifically located in the endpoint at /editor/elfinder/php/connector.php. This vulnerability arises because the 'name' parameter in rename commands is not adequately sanitized, allowing attackers to insert directory traversal sequences. Consequently, malicious users could relocate files from project media directories to any location on the filesystem, which poses significant risks such as overwriting application files, facilitating stored cross-site scripting, or exploiting other vulnerabilities to execute arbitrary PHP code remotely.

References