A critical path traversal vulnerability in Xerte Online Toolkits versions 3.15.0 and earlier can be exploited to overwrite system files or achieve remote code execution.

This is a relative path traversal vulnerability (CWE-22) located in the elFinder connector at /editor/elfinder/php/connector.php. An attacker can manipulate the name parameter during rename operations to escape the intended media directory, allowing for the relocation of arbitrary files on the filesystem.

Successful exploitation poses a severe risk to organizational security, as the vulnerability can be chained to achieve remote code execution (RCE). By moving malicious files to the application root, an attacker gains the ability to execute arbitrary commands, leading to full system compromise, unauthorized access to sensitive data, and potential lateral movement within the network. The CVSS score of 7.1 reflects the high impact on system integrity, and the capability for RCE elevates the urgency of this remediation.

Immediate Action: Upgrade to the latest version of Xerte Online Toolkits where this vulnerability is patched (versions 3.13, 3.14, and 3.15 contain backported security fixes).

Proactive Monitoring: Review web server access logs for suspicious requests directed at /editor/elfinder/php/connector.php, particularly those containing directory traversal sequences like "../".

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to filter and block requests to the connector endpoint containing path traversal patterns or unauthorized parameter manipulation.

Public Exploit Available: Yes, a Metasploit module exists and public proof-of-concept code is available via the researcher's write-up on GitHub.

The presence of a weaponized exploit module in Metasploit significantly increases the likelihood of opportunistic attacks. Administrators must prioritize patching this vulnerability immediately to prevent potential remote code execution. If an immediate update is not feasible, restrict access to the affected directory until the patch can be applied.