CVE-2026-34414 is a CWE-22 path traversal vulnerability affecting Xerte Online Toolkits up to version 3.15. The vulnerability exists in the /editor/elfinder/php/connector.php endpoint where the name parameter in rename commands is not properly sanitized. Attackers can supply directory traversal sequences to move files from project media directories to arbitrary filesystem locations. This can result in overwriting critical application files, enabling stored XSS, or combined with other vulnerabilities, lead to unauthenticated remote code execution by moving malicious PHP files to the application root directory.

Successful exploitation allows an attacker with at least limited privileges to move files arbitrarily on the server filesystem. This can overwrite application files, cause stored cross-site scripting, or enable unauthenticated remote code execution by placing PHP code in the application root. The vulnerability thus poses a high risk to application integrity, confidentiality, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable endpoint and monitor for suspicious file operations. Avoid exposing the elFinder connector endpoint to untrusted users.