CVE-2026-34413: Xerte Online Toolkits Missing Authentication via connector.php
Xerte Online Toolkits versions 3.15 and earlier contain a missing authentication vulnerability in the elFinder connector endpoint at /editor/elfinder/php/connector.php where an HTTP redirect to unauthenticated callers does not call exit() or die(), allowing PHP execution to continue and process the full request server-side. Unauthenticated attackers can perform file operations on project media directories including creating directories, uploading files, renaming files, duplicating files, overwriting files, and deleting files, which can be chained with path traversal and extension blocklist vulnerabilities to achieve remote code execution and arbitrary file read.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Xerte Online Toolkitsto a version that resolves this vulnerability.Fixed in 3.15 - Configuration
In /editor/elfinder/php/connector.php at the elFinder connector endpoint, modify the missing-authentication branch so that after redirecting unauthenticated callers, execution is terminated (use exit() or die()), preventing further server-side request processing.
Xerte Online Toolkits (editor/elfinder/php/connector.php) Missing authentication handling (HTTP redirect to unauthenticated callers must terminate execution) = Ensure the redirect path calls exit() or die() so PHP execution does not continue after redirect.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-34413?
CVE-2026-34413 has a medium severity level due to its ability to allow unauthenticated access.
How do I fix CVE-2026-34413?
To fix CVE-2026-34413, update Xerte Online Toolkits to version 3.16 or later, where the vulnerability has been addressed.
What specific component is impacted by CVE-2026-34413?
CVE-2026-34413 specifically impacts the elFinder connector endpoint located at /editor/elfinder/php/connector.php.
Who is affected by CVE-2026-34413?
Users of Xerte Online Toolkits versions 3.15 and earlier are affected by CVE-2026-34413.
What could an attacker achieve with CVE-2026-34413?
An attacker could exploit CVE-2026-34413 to gain unauthorized access to resources through the vulnerable endpoint.