CVE-2026-34414 is a CWE-22 path traversal vulnerability affecting Xerte Online Toolkits up to version 3.15. The issue exists in the elFinder connector endpoint at /editor/elfinder/php/connector.php, where the 'name' parameter in rename commands lacks proper sanitization for path traversal sequences. This allows an attacker with at least limited privileges to move files outside intended directories, potentially overwriting critical application files. The vulnerability can be leveraged to achieve stored cross-site scripting or, when combined with other vulnerabilities, unauthenticated remote code execution by relocating malicious PHP files to the application root directory.

Successful exploitation allows attackers to move files arbitrarily on the filesystem, which can overwrite application files and lead to stored cross-site scripting. Furthermore, it may enable unauthenticated remote code execution if combined with other vulnerabilities by placing malicious PHP code in the application root. The CVSS 4.0 base score is 7.1 (high severity), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are currently available. Until a patch is released, restrict access to the vulnerable endpoint and monitor for suspicious file operations. Avoid exposing the elFinder connector endpoint to untrusted users. Follow vendor advisories for updates on remediation.