CVE-2026-34413 affects Xerte Online Toolkits up to version 3.15. The vulnerability arises because the elFinder connector endpoint at /editor/elfinder/php/connector.php performs an HTTP redirect for unauthenticated callers but does not call exit() or die(), allowing PHP execution to continue. This missing authentication check permits unauthenticated attackers to manipulate files within project media directories, including creating, uploading, renaming, duplicating, overwriting, and deleting files. When chained with path traversal and extension blocklist bypass vulnerabilities, this can lead to remote code execution and arbitrary file read. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on integrity and availability.

The vulnerability allows unauthenticated attackers to perform unauthorized file operations on the server hosting Xerte Online Toolkits. This can lead to remote code execution and arbitrary file read, potentially compromising the confidentiality, integrity, and availability of the affected system. The high CVSS score of 8.8 reflects the significant risk posed by this vulnerability if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected endpoint and consider implementing additional access controls or web application firewall rules to block unauthenticated requests to /editor/elfinder/php/connector.php. Monitor for updates from the vendor regarding patches or official mitigations.