Xerte Online Toolkits File Upload RCE via elfinder Connector
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
Xerte Online Toolkits versions 3.15 and earlier contain an incomplete input validation vulnerability in the elFinder connector endpoint that fails to block PHP-executable extensions .php4 due to an incorrect regex pattern. Unauthenticated attackers can exploit this flaw combined with authentication bypass and path traversal vulnerabilities to upload malicious PHP code, rename it with a .php4 extension, and execute arbitrary operating system commands on the server.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| thexerteproject | xerteonlinetoolkits | up to 3.15.0 | — | No fix listed | CNA |
- xerteonlinetoolkits Vendorthexerteproject Affected up to 3.15.0 Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-34415
- 2026-10-03 Alias added: GHSA-67j3-r63p-59hf
- 2026-10-25 EPSS moved to the 50th–90th percentile
References
Patch 3
- https://github.com/thexerteproject/xerteonlinetoolkits/commit/02661be88cc369325ea01b508086bde7fbfec805
- https://github.com/thexerteproject/xerteonlinetoolkits/commit/17e4f945fe6a3400fa88c01eda18c1075ee4a212
- https://github.com/thexerteproject/xerteonlinetoolkits/commit/507d55c5e91bf9310b5b1c7fad8aebfef902ad23
More thexerteproject vulnerabilities
- TI-2026-81652 Remote code execution in Xerte Online Toolkits via language pack import CVSS 4.0HIGH 8.6
- TI-2026-26695 Xerte Online Toolkits Path Traversal via connector.php CVSS 4.0HIGH 7.1
- TI-2026-26694 Xerte Online Toolkits Missing Authentication via connector.php CVSS 4.0HIGH 8.8
- TI-2026-30048 Xerte Online Toolkits Path Disclosure via /setup CVSS 4.0MEDIUM 6.9
Sources
- CVE-2026-34415 · CVE Program
- CVE-2026-34415 · NVD
- FIRST EPSS
- GHSA-67j3-r63p-59hf · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences