CVE-2026-34414: Thexerteproject Xerteonlinetoolkits

High severity, CVSS 7.1. EPSS: 3.6% chance of exploitation in the next 30 days.

Xerte Online Toolkits versions 3.15 and earlier contain a relative path traversal vulnerability in the elFinder connector endpoint at /editor/elfinder/php/connector.php where the name parameter in rename commands is not sanitized for path traversal sequences. Attackers can supply a name value containing directory traversal sequences to move files from project media directories to arbitrary locations on the filesystem, potentially overwriting application files, achieving stored cross-site scripting, or combining with other vulnerabilities to achieve unauthenticated remote code execution by moving PHP code files to the application root.

Affected products

• Thexerteproject Xerteonlinetoolkits: up to and including 3.15.0

Published 2026-04-22. Last modified 2026-07-14.