CVE-2026-34415: Xerte Online Toolkits File Upload RCE via elfinder Connector
Xerte Online Toolkits versions 3.15 and earlier contain an incomplete input validation vulnerability in the elFinder connector endpoint that fails to block PHP-executable extensions .php4 due to an incorrect regex pattern. Unauthenticated attackers can exploit this flaw combined with authentication bypass and path traversal vulnerabilities to upload malicious PHP code, rename it with a .php4 extension, and execute arbitrary operating system commands on the server.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Xerte Online Toolkitsto a version that resolves this vulnerability.Fixed in 3.15 and earlier contain an incomplete input validation vulnerability - Configuration
Fix the incorrect regex pattern so that the elFinder connector endpoint blocks PHP-executable extension .php4 (Xerte Online Toolkits v3.15 and earlier fails to block .php4 due to an incorrect regex pattern).
elFinder connector endpoint (Xerte Online Toolkits) Block PHP-executable extensions = .php4
Event History
Frequently Asked Questions
What is the severity of CVE-2026-34415?
CVE-2026-34415 is rated as a critical vulnerability due to its potential for remote code execution.
How do I fix CVE-2026-34415?
To fix CVE-2026-34415, upgrade to Xerte Online Toolkits version 3.16 or later.
What versions of Xerte Online Toolkits are affected by CVE-2026-34415?
Xerte Online Toolkits versions 3.15 and earlier are affected by CVE-2026-34415.
What type of vulnerability is CVE-2026-34415?
CVE-2026-34415 is an input validation vulnerability that allows for remote code execution.
Can CVE-2026-34415 be exploited without authentication?
Yes, CVE-2026-34415 can be exploited by unauthenticated users.