CVE-2026-34415

CRITICAL 9.8

Xerte Online Toolkits File Upload RCE via elfinder Connector

CVSS Score

9.8

EPSS Score

0.0%

EPSS Percentile

0th

Xerte Online Toolkits versions 3.15 and earlier contain an incomplete input validation vulnerability in the elFinder connector endpoint that fails to block PHP-executable extensions .php4 due to an incorrect regex pattern. Unauthenticated attackers can exploit this flaw combined with authentication bypass and path traversal vulnerabilities to upload malicious PHP code, rename it with a .php4 extension, and execute arbitrary operating system commands on the server.

CWE	CWE-184
Vendor	thexerteproject
Product	xerteonlinetoolkits
Published	Apr 22, 2026
Last Updated	Apr 22, 2026

Stay Ahead of the Next One

Get instant alerts for thexerteproject xerteonlinetoolkits

Be the first to know when new critical vulnerabilities affecting thexerteproject xerteonlinetoolkits are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

thexerteproject / xerteonlinetoolkits

3.15.0 3.14.0 3.13.0 0 < 02661be88cc369325ea01b508086bde7fbfec805 0 < 17e4f945fe6a3400fa88c01eda18c1075ee4a212 0 < 507d55c5e91bf9310b5b1c7fad8aebfef902ad23

References

NVD ↗ CVE.org ↗ EPSS Data ↗

xerte.org.uk: https://xerte.org.uk/xertetoolkits_3.15_ChangeLog.html xerte.org.uk: https://xerte.org.uk/index.php/en/downloads-1/category/3-xerte-online-toolkits github.com: https://github.com/thexerteproject/xerteonlinetoolkits/issues/1527 github.com: https://github.com/thexerteproject/xerteonlinetoolkits/commit/02661be88cc369325ea01b508086bde7fbfec805 github.com: https://github.com/thexerteproject/xerteonlinetoolkits/commit/17e4f945fe6a3400fa88c01eda18c1075ee4a212 github.com: https://github.com/thexerteproject/xerteonlinetoolkits/commit/507d55c5e91bf9310b5b1c7fad8aebfef902ad23 vulncheck.com: https://www.vulncheck.com/advisories/xerte-online-toolkits-file-upload-rce-via-elfinder-connector

Credits

bootstrapbool