PT-2026-34537 · Thexerteproject · Xerte Online Toolkits

Bootstrapbool · Published 2026-04-22 · Updated 2026-04-22 · CVE-2026-34415

NVD

CVSS v3.1

9.8

Critical

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Xerte Online Toolkits versions 3.15 and earlier contain an incomplete input validation vulnerability in the elFinder connector endpoint that fails to block PHP-executable extensions .php4 due to an incorrect regex pattern. Unauthenticated attackers can exploit this flaw combined with authentication bypass and path traversal vulnerabilities to upload malicious PHP code, rename it with a .php4 extension, and execute arbitrary operating system commands on the server.

Fix

RCE

Incomplete List of Disallowed Inputs

Weakness Enumeration

CWE-184

Related Identifiers

CVE-2026-34415

Affected Products

Xerte Online Toolkits

References · 10

• https://github.com/thexerteproject/xerteonlinetoolkits/commit/02661be88cc369325ea01b508086bde7fbfec805 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-34415 · Security Note
• https://github.com/thexerteproject/xerteonlinetoolkits/commit/17e4f945fe6a3400fa88c01eda18c1075ee4a212 · Patch
• https://github.com/thexerteproject/xerteonlinetoolkits/commit/507d55c5e91bf9310b5b1c7fad8aebfef902ad23 · Patch
• https://vulncheck.com/advisories/xerte-online-toolkits-file-upload-rce-via-elfinder-connector · Note
• https://xerte.org.uk/xertetoolkits_3.15_ChangeLog.html · Note
• https://twitter.com/0dayPublishing/status/2047026380861296909 · Twitter Post
• https://github.com/thexerteproject/xerteonlinetoolkits/issues/1527 · Note
• https://twitter.com/OrizonCyber/status/2047035224484094198 · Twitter Post
• https://xerte.org.uk/index.php/en/downloads-1/category/3-xerte-online-toolkits · Note