CVE-2026-34414: Xerte Online Toolkits Path Traversal via connector.php
Xerte Online Toolkits versions 3.15 and earlier contain a relative path traversal vulnerability in the elFinder connector endpoint at /editor/elfinder/php/connector.php where the name parameter in rename commands is not sanitized for path traversal sequences. Attackers can supply a name value containing directory traversal sequences to move files from project media directories to arbitrary locations on the filesystem, potentially overwriting application files, achieving stored cross-site scripting, or combining with other vulnerabilities to achieve unauthenticated remote code execution by moving PHP code files to the application root.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Xerte Online Toolkitsto a version that resolves this vulnerability.Fixed in 3.15 - Compensating control
Restrict access to the /editor/elfinder/php/connector.php endpoint so only trusted users/systems can reach the elFinder connector.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-34414?
CVE-2026-34414 is classified as a high-severity vulnerability due to its potential for path traversal attacks.
How do I fix CVE-2026-34414?
To fix CVE-2026-34414, update Xerte Online Toolkits to version 3.16 or later where this issue is resolved.
What vulnerabilities does CVE-2026-34414 introduce?
CVE-2026-34414 introduces a relative path traversal vulnerability that can be exploited by attackers to access unauthorized files.
Which versions of Xerte Online Toolkits are affected by CVE-2026-34414?
CVE-2026-34414 affects Xerte Online Toolkits versions 3.15 and earlier.
What kind of attacks can be performed exploiting CVE-2026-34414?
Exploiting CVE-2026-34414 allows attackers to manipulate the file paths, potentially leading to unauthorized file access on the server.