CVE-2026-34415: Xerte Online Toolkits elFinder Connector Incomplete Input Validation RCE
CVE-2026-34415 affects Xerte Online Toolkits 3.15 and earlier. A regular expression in the elFinder connector fails to block the .php4 extension, and the record links this to authentication bypass and path traversal issues that could allow command execution on the server. The record gives a CVSS 3.1 score of 9.8 (Critical) and is not listed in CISA KEV.
Overview
CVE-2026-34415 affects Xerte Online Toolkits versions 3.15 and earlier. According to the record, the elFinder connector endpoint has an incomplete input validation flaw: a regular expression intended to block PHP-executable extensions does not cover .php4. The record classifies the weakness as CWE-184 (incomplete list of disallowed inputs).
Impact
- The record states that unauthenticated attackers could chain this flaw with authentication bypass and path traversal issues to run arbitrary operating system commands on the server.
- The CVSS 3.1 base score is 9.8 (Critical), with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, provided by the CNA VulnCheck.
- A CVSS 4.0 score of 9.3 is also listed by the same provider.
- The v3.1 vector rates confidentiality, integrity and availability impacts as high.
Affected products and versions
- Product: Xerte Online Toolkits, versions 3.15 and earlier, as stated in the record description.
- The structured affected and fixed-version fields in the record are empty, so the version range comes only from the description text.
- Whether later versions contain the fix cannot be determined from the record alone.
Exploitation status
- The record shows the CVE is not listed in CISA KEV.
- No confirmed exploitation in the wild appears in the sources consulted for this analysis.
- The EPSS probability is 0.04428 with a percentile of 0.9117, as recorded.
Remediation and mitigation
- Review the vendor download page and the 3.15 changelog listed in the record, and confirm the fixed release with the vendor.
- Plan an upgrade to a release the vendor documents as containing the fix. The record does not confirm which release this is.
- Until patched, limit exposure of the toolkit to trusted networks and review whether the elFinder connector needs to be reachable from the internet.
- Treat any unexpected PHP files in upload or content directories as a possible compromise and investigate them.
Detection guidance
- Review web server logs for requests to the elFinder connector that show unusual file operations or unexpected file names.
- Monitor for newly created or renamed server-side scripts, especially those with less common PHP-related extensions.
- Look for unexpected child processes started by the web server account.
- Compare the application directory against a known-good baseline to find unauthorized files.
Limitations of the available information
- The record has no structured affected or fixed version data, and no KEV or SSVC entry.
- The CWE name field is empty in the record.
- The authentication bypass and path traversal components are described only at the summary level.
- The EPSS date in the record (2026-10-13) is later than the publication date (2026-04-22), so the figure should be interpreted with care.
Frequently asked questions
Which versions of Xerte Online Toolkits are affected?
The record describes versions 3.15 and earlier as affected. The structured affected-version field is empty, so confirm the exact range with the vendor.
Is this vulnerability being actively exploited?
The record shows the CVE is not listed in CISA KEV, and no confirmed exploitation in the wild appears in the sources consulted for this analysis.
What should administrators do now?
Check the vendor release information, plan an upgrade to a release documented as fixed, limit exposure of the toolkit, and review web server logs and application files for unexpected PHP files.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.