Xerte Online Toolkits version 3.15 and earlier expose a missing authentication flaw in the elFinder connector endpoint located at /editor/elfinder/php/connector.php. The connector performs an HTTP redirect for unauthenticated callers but does not terminate execution with exit() or die(), which means the PHP script continues to process the request. As a result, unauthenticated attackers can execute file operations against the project media directories, including creating, uploading, renaming, duplicating, overwriting, and deleting files. By chaining these operations with existing path traversal and extension blocklist vulnerabilities, an attacker can gain remote code execution and read arbitrary files, threatening confidentiality and integrity.

The affected vendor is thexerteproject with its Xerte Online Toolkits product. All releases up to and including 3.15 are vulnerable.

The vulnerability is assigned a CVSS score of 8.8, indicating high severity, and EPSS data is not available. The weakness is not listed in the CISA KEV catalog. An unauthenticated attacker can directly send HTTP requests to the connector endpoint to conduct the file operations described. The combination with other known path traversal or extension-based flaws amplifies the risk to remote code execution, making exploitation feasible for a skilled adversary.