CVE-2026-34414

EIP tracks 1 public exploit for CVE-2026-34414. Includes Metasploit module exploits/multi/http/xerte_unauthenticated_mediaupload.

AI-analyzed exploit summary This Metasploit module exploits an unauthenticated arbitrary file upload vulnerability in Xerte Online Toolkits by bypassing authentication, extension blacklists, and path traversal restrictions to upload and execute a PHP shell.

Xerte Online Toolkits versions 3.15 and earlier contain a relative path traversal vulnerability in the elFinder connector endpoint at /editor/elfinder/php/connector.php where the name parameter in rename commands is not sanitized for path traversal sequences. Attackers can supply a name value containing directory traversal sequences to move files from project media directories to arbitrary locations on the filesystem, potentially overwriting application files, achieving stored cross-site scripting, or combining with other vulnerabilities to achieve unauthenticated remote code execution by moving PHP code files to the application root.