Xerte Online Toolkits versions 3.15 and earlier contain a missing authentication vulnerability in the elFinder connector endpoint at /editor/elfinder/php/connec…

Xerte Online Toolkits versions 3.15 and earlier contain a critical missing authentication vulnerability in the elFinder connector endpoint. The vulnerability occurs when HTTP redirects to unauthenticated users fail to call exit() or die(), allowing PHP execution to continue processing requests server-side. Unauthenticated attackers can perform extensive file operations including creating, uploading, renaming, duplicating, overwriting, and deleting files in project media directories. This vulnerability can be chained with path traversal and extension blocklist bypasses to achieve remote code execution and arbitrary file read capabilities, making it a severe security risk for affected installations.