CVE-2026-34415 | Xerte Online Toolkits versions 3.15 and earlier contain an i… | CVSS 9.8 CRITICAL

Description

Xerte Online Toolkits versions 3.15 and earlier contain an incomplete input validation vulnerability in the elFinder connector endpoint that fails to block PHP-executable extensions .php4 due to an incorrect regex pattern. Unauthenticated attackers can exploit this flaw combined with authentication bypass and path traversal vulnerabilities to upload malicious PHP code, rename it with a .php4 extension, and execute arbitrary operating system commands on the server.

Metadata

CVE ID: CVE-2026-34415
State: PUBLISHED
Assigner: VulnCheck
Reserved: 2026-03-27 15:24 UTC
Published: 2026-04-22 18:33 UTC
Last updated: 2026-07-14 18:40 UTC
Primary CWE: CWE-184
CWE-184 Incomplete List of Disallowed Inputs
Vendor / Product: thexerteproject / xerteonlinetoolkits
Sources: cve.org · NVD

Severity & Metrics

9.8 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: none
Automatable: no
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
thexerteproject	xerteonlinetoolkits	—	0 ≤ 3.15.0

Weakness (CWE)

CWE	Source	Description
CWE-184	cna	CWE-184 Incomplete List of Disallowed Inputs

CVSS scores (2)

Score	Severity	Version	Source	Vector
9.8	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.3	CRITICAL	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References (8)