Xerte Online Toolkits RCE: Unauthenticated File Operations

The National Vulnerability Database reports CVE-2026-34413 in Xerte Online Toolkits versions 3.15 and earlier. This critical vulnerability stems from a missing authentication flaw in the /editor/elfinder/php/connector.php endpoint. An HTTP redirect to unauthenticated users fails to terminate PHP execution, allowing the server to process the full request. This isn’t just a bypass; it’s a fundamental breakdown of access control.

Attackers can exploit this to perform a wide range of file operations on project media directories, including creating, uploading, renaming, duplicating, overwriting, and deleting files. The National Vulnerability Database indicates that these operations can be chained with path traversal and extension blocklist bypasses to achieve unauthenticated remote code execution (RCE) and arbitrary file reads. This is a severe weakness, scoring 8.6 (HIGH) on the CVSS scale.

For defenders, this means any public-facing Xerte instance running vulnerable versions is a direct entry point for attackers to compromise the underlying server. The attacker’s calculus is straightforward: find a vulnerable instance, upload a web shell, and gain full control. This isn’t a theoretical threat; it’s a clear path to system takeover.