CVE-2026-34415
CriticalCVSS 9.8Exploitation Probability (EPSS)
High risk88th percentile - higher than 88% of all known CVEs
Summary
Xerte Online Toolkits versions 3.15 and earlier have an incomplete input validation vulnerability in the elFinder connector endpoint that fails to block the .php4 extension due to an incorrect regex pattern. Unauthenticated attackers can exploit this flaw combined with authentication bypass and path traversal to upload malicious PHP code and execute arbitrary system commands on the server.
Risk Assessment
The risk for the organization includes full server compromise by an unauthenticated attacker, potentially leading to data theft, content modification, or use of the server for further attacks.
Recommendation
Immediately upgrade Xerte Online Toolkits to version 3.16 or later, which includes a fix for file extension validation. If an upgrade is not possible, temporarily disable the elFinder endpoint or apply WAF rules to block file uploads with the .php4 extension.
Original NVD description (English source)
Xerte Online Toolkits versions 3.15 and earlier contain an incomplete input validation vulnerability in the elFinder connector endpoint that fails to block PHP-executable extensions .php4 due to an incorrect regex pattern. Unauthenticated attackers can exploit this flaw combined with authentication bypass and path traversal vulnerabilities to upload malicious PHP code, rename it with a .php4 extension, and execute arbitrary operating system commands on the server.