CVE-2026-34414 is a CWE-22 path traversal vulnerability affecting Xerte Online Toolkits up to version 3.15. The issue exists in the elFinder connector endpoint at /editor/elfinder/php/connector.php, where the 'name' parameter in rename commands lacks proper sanitization against directory traversal sequences. This allows an attacker with at least limited privileges to move files outside intended directories, potentially overwriting critical application files. The vulnerability can be leveraged to achieve stored XSS or, in combination with other vulnerabilities, unauthenticated remote code execution by moving malicious PHP files to the application root directory.

Successful exploitation can allow an attacker to move files arbitrarily on the filesystem, leading to overwriting of application files. This may result in stored cross-site scripting attacks or, when combined with other vulnerabilities, unauthenticated remote code execution. The CVSS 4.0 score is 7.1 (high severity), indicating significant risk if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable endpoint and monitor for suspicious file operations. Avoid exposing the elFinder connector endpoint to untrusted users. Follow vendor updates closely for an official patch or mitigation instructions.