CVE-2026-34413: CWE-497 Exposure of Sensitive System Information to an Unauthorized Control Sphere in thexerteproject xerteonlinetoolkits
Xerte Online Toolkits versions 3.15 and earlier contain a missing authentication vulnerability in the elFinder connector endpoint at /editor/elfinder/php/connector.php where an HTTP redirect to unauthenticated callers does not call exit() or die(), allowing PHP execution to continue and process the full request server-side. Unauthenticated attackers can perform file operations on project media directories including creating directories, uploading files, renaming files, duplicating files, overwriting files, and deleting files, which can be chained with path traversal and extension blocklist vulnerabilities to achieve remote code execution and arbitrary file read.
AI Analysis
Technical Summary
CVE-2026-34413 affects Xerte Online Toolkits up to version 3.15 and earlier. The vulnerability is due to missing authentication enforcement in the elFinder connector endpoint (/editor/elfinder/php/connector.php). When unauthenticated requests are redirected, the PHP script does not exit, allowing the request to continue processing server-side. This enables unauthenticated attackers to manipulate files within project media directories, including creating, uploading, renaming, duplicating, overwriting, and deleting files. Combined with path traversal and extension blocklist bypass vulnerabilities, this can lead to remote code execution and arbitrary file read capabilities.
Potential Impact
Unauthenticated attackers can perform unauthorized file operations on the server hosting Xerte Online Toolkits, potentially leading to remote code execution and arbitrary file disclosure. This compromises the confidentiality, integrity, and availability of the affected system and its data.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the elFinder connector endpoint and monitor for suspicious activity. Avoid exposing the vulnerable endpoint to untrusted networks.
CVE-2026-34413: CWE-497 Exposure of Sensitive System Information to an Unauthorized Control Sphere in thexerteproject xerteonlinetoolkits
Description
Xerte Online Toolkits versions 3.15 and earlier contain a missing authentication vulnerability in the elFinder connector endpoint at /editor/elfinder/php/connector.php where an HTTP redirect to unauthenticated callers does not call exit() or die(), allowing PHP execution to continue and process the full request server-side. Unauthenticated attackers can perform file operations on project media directories including creating directories, uploading files, renaming files, duplicating files, overwriting files, and deleting files, which can be chained with path traversal and extension blocklist vulnerabilities to achieve remote code execution and arbitrary file read.
CVSS v4.0
Score 8.8high
Affected software
pkg:github/thexerteproject/xerteonlinetoolkitsRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-34413 affects Xerte Online Toolkits up to version 3.15 and earlier. The vulnerability is due to missing authentication enforcement in the elFinder connector endpoint (/editor/elfinder/php/connector.php). When unauthenticated requests are redirected, the PHP script does not exit, allowing the request to continue processing server-side. This enables unauthenticated attackers to manipulate files within project media directories, including creating, uploading, renaming, duplicating, overwriting, and deleting files. Combined with path traversal and extension blocklist bypass vulnerabilities, this can lead to remote code execution and arbitrary file read capabilities.
Potential Impact
Unauthenticated attackers can perform unauthorized file operations on the server hosting Xerte Online Toolkits, potentially leading to remote code execution and arbitrary file disclosure. This compromises the confidentiality, integrity, and availability of the affected system and its data.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the elFinder connector endpoint and monitor for suspicious activity. Avoid exposing the vulnerable endpoint to untrusted networks.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-03-27T15:24:06.752Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69e91af419fe3cd2cde2a8ac
Added to database: 04/22/2026, 19:01:08 UTC
Last enriched: 07/15/2026, 10:55:29 UTC
Last updated: 07/31/2026, 19:22:58 UTC
Views: 139
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.