Xerte Online Toolkits Missing Authentication via connector.php
Summary
| CVE | CVE-2026-34413 |
|---|---|
| State | PUBLISHED |
| Assigner | VulnCheck |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-04-22 19:17:02 UTC |
| Updated | 2026-04-22 21:18:45 UTC |
| Description | Xerte Online Toolkits versions 3.15 and earlier contain a missing authentication vulnerability in the elFinder connector endpoint at /editor/elfinder/php/connector.php where an HTTP redirect to unauthenticated callers does not call exit() or die(), allowing PHP execution to continue and process the full request server-side. Unauthenticated attackers can perform file operations on project media directories including creating directories, uploading files, renaming files, duplicating files, overwriting files, and deleting files, which can be chained with path traversal and extension blocklist vulnerabilities to achieve remote code execution and arbitrary file read. |
Risk And Classification
Primary CVSS: v4.0 8.8 HIGH from [email protected]
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Problem Types: CWE-497 | CWE-497 CWE-497 Exposure of Sensitive System Information to an Unauthorized Control Sphere
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 4.0 | [email protected] | Secondary | 8.8 | HIGH | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/C... |
| 4.0 | CNA | CVSS | 8.8 | HIGH | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N |
| 3.1 | [email protected] | Primary | 8.6 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L |
| 3.1 | CNA | CVSS | 8.6 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L |
CVSS v4.0 Breakdown
Attack Vector
NetworkAttack Complexity
LowAttack Requirements
NonePrivileges Required
NoneUser Interaction
NoneConfidentiality
LowIntegrity
HighAvailability
LowSub Conf.
NoneSub Integrity
NoneSub Availability
NoneCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
LowPrivileges Required
NoneUser Interaction
NoneScope
UnchangedConfidentiality
LowIntegrity
HighAvailability
LowCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Thexerteproject | Xerteonlinetoolkits | affected 3.15.0 semver | Not specified |
| CNA | Thexerteproject | Xerteonlinetoolkits | affected 3.14.0 semver | Not specified |
| CNA | Thexerteproject | Xerteonlinetoolkits | affected 3.13.0 semver | Not specified |
| CNA | Thexerteproject | Xerteonlinetoolkits | affected 02661be88cc369325ea01b508086bde7fbfec805 git | Not specified |
| CNA | Thexerteproject | Xerteonlinetoolkits | affected 17e4f945fe6a3400fa88c01eda18c1075ee4a212 git | Not specified |
| CNA | Thexerteproject | Xerteonlinetoolkits | affected 507d55c5e91bf9310b5b1c7fad8aebfef902ad23 git | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| github.com/thexerteproject/xerteonlinetoolkits/issues/1527 | [email protected] | github.com | |
| github.com/thexerteproject/xerteonlinetoolkits/commit/02661be88cc369325e... | [email protected] | github.com | |
| www.vulncheck.com/advisories/xerte-online-toolkits-missing-authentication-via-c... | [email protected] | www.vulncheck.com | |
| github.com/thexerteproject/xerteonlinetoolkits/commit/17e4f945fe6a3400fa... | [email protected] | github.com | |
| github.com/thexerteproject/xerteonlinetoolkits/commit/507d55c5e91bf9310b... | [email protected] | github.com | |
| xerte.org.uk/xertetoolkits_3.15_ChangeLog.html | [email protected] | xerte.org.uk | |
| xerte.org.uk/index.php/en/downloads-1/category/3-xerte-online-toolkits | [email protected] | xerte.org.uk | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: bootstrapbool (en)
There are currently no legacy QID mappings associated with this CVE.