The vulnerability is a relative path traversal flaw in the elFinder connector of Xerte Online Toolkits. Specifically, the "name" parameter in rename commands is not validated for traversal sequences, allowing an attacker to specify paths that move files from project media directories to arbitrary locations. This defect enables an attacker to overwrite application files, embed stored cross‑site scripting payloads, or, if combined with other weaknesses, to place PHP code in the application root and achieve unauthenticated remote code execution. The weakness is classified as CWE‑22, a classic path traversal issue.

The affected product is Xerte Online Toolkits from The Xerte Project. Versions 3.15 and earlier are vulnerable; all later releases are considered safe if updated accordingly.

The CVSS score of 7.1 reflects a moderate severity. No EPSS score is publicly available, and the issue is not listed in the CISA KEV catalog, suggesting no known widespread exploitation at this time. Potential attackers can exploit the flaw remotely by sending crafted HTTP requests to /editor/elfinder/php/connector.php, leveraging the unsanitized "name" parameter to write arbitrary files and ultimately compromise the server if PHP files are dropped into the web root.