8.6
HighCVSS 3.1 · from VulnCheck
CVE-2026-34413
Xerte Online Toolkits Missing Authentication via connector.php
xerteonlinetoolkits · CWE-497 · CWE-497Affectedxerteonlinetoolkits
FixA patch is linked in the references.
PublishedApr 22, 18:33 · VulnCheck
ScoredApr 22 · 8.6 · VulnCheck
Exploit code publicNov 1 · Metasploit
ExploitedNone known · CISA KEV checked 22:05 UTC
What we know
No known exploitation. CISA KEV, checked 22:05 UTC.
Public exploit code exists. Metasploit, Nuclei.
An attacker only needs network access to the target. No login needed. CVSS: network, no privileges.
A successful attack can change data. CVSS impact.
Description
Xerte Online Toolkits versions 3.15 and earlier contain a missing authentication vulnerability in the elFinder connector endpoint at /editor/elfinder/php/connector.php where an HTTP redirect to unauthenticated callers does not call exit() or die(), allowing PHP execution to continue and process the full request server-side. Unauthenticated attackers can perform file operations on project media directories including creating directories, uploading files, renaming files, duplicating files, overwriting files, and deleting files, which can be chained with path traversal and extension blocklist vulnerabilities to achieve remote code execution and arbitrary file read.
From VulnCheck
Affected and fixed versions
ProductAffectedFixed inxerteonlinetoolkitsup to 3.15.0–
Exploit code
Exploit-DBnone knownMetasploit1 entryNuclei1 entry
Xerte Online Toolkits Arbitrary File Upload - Unauthenticated Media UploadMetasploit · not verified by usOpenXerte Online Toolkits <= 3.15 - Remote Code Execution
Nuclei · not verified by usOpen