Skip to main content

Xerte Online Toolkits CVE-2026-34415

| EUVD-2026-25069 CRITICAL
Incomplete List of Disallowed Inputs (CWE-184)
2026-04-22 VulnCheck
PHP Authentication Bypass Path Traversal
9.3
CVSS 4.0 · NVD
Share

Severity by source

NVD PRIMARY
9.3 CRITICAL
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

7
Re-analysis Queued
Apr 24, 2026 - 20:22 vuln.today
cvss_changed
Analysis Generated
Apr 23, 2026 - 06:44 vuln.today
CVSS changed
Apr 22, 2026 - 19:22 NVD
9.8 (CRITICAL) 9.3 (CRITICAL)
EUVD ID Assigned
Apr 22, 2026 - 19:01 euvd
EUVD-2026-25069
Analysis Generated
Apr 22, 2026 - 19:01 vuln.today
Patch released
Apr 22, 2026 - 19:01 nvd
Patch available
CVE Published
Apr 22, 2026 - 18:33 nvd
CRITICAL 9.3

DescriptionCVE.org

Xerte Online Toolkits versions 3.15 and earlier contain an incomplete input validation vulnerability in the elFinder connector endpoint that fails to block PHP-executable extensions .php4 due to an incorrect regex pattern. Unauthenticated attackers can exploit this flaw combined with authentication bypass and path traversal vulnerabilities to upload malicious PHP code, rename it with a .php4 extension, and execute arbitrary operating system commands on the server.

AnalysisAI

Remote code execution in Xerte Online Toolkits 3.15 and earlier allows unauthenticated attackers to upload and execute arbitrary PHP code by chaining an incomplete file extension filter bypass (.php4 extension) with authentication bypass and path traversal vulnerabilities in the elFinder connector endpoint. Attackers can achieve complete server compromise by uploading malicious PHP files, renaming them with the .php4 extension to evade filtering, and executing operating system commands. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Access elFinder connector endpoint
Delivery
Bypass authentication checks
Exploit
Upload malicious PHP file with safe extension
Execution
Exploit path traversal to web directory
Persist
Rename file to .php4 extension
Impact
Execute arbitrary OS commands
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires the Xerte Online Toolkits elFinder connector endpoint to be network-accessible and the web server configured to execute legacy PHP extensions (.php4, .php5, .phtml) - this is default behavior in many Apache configurations with mod_php or PHP-FPM using legacy AddType or AddHandler directives. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment This represents critical real-world risk despite absence from CISA KEV. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker discovers an internet-facing Xerte Online Toolkits installation through search engine dorking or automated scanning for the elFinder connector endpoint. Without requiring credentials, they exploit the authentication bypass to access the file management API, then upload a PHP webshell disguised with a benign extension like .txt. …
Remediation Immediately upgrade to Xerte Online Toolkits version incorporating all three security patches (commits 02661be, 17e4f94, 507d55c available at https://github.com/thexerteproject/xerteonlinetoolkits). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: Identify all Xerte Online Toolkits instances in your environment and confirm versions (target versions 3.15 and earlier). …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More from same product – last 7 days

CVE-2026-49952 CRITICAL POC
9.3 Jun 15

Authentication bypass in Discuz! X5.0 releases 20260320 through 20260501 allows unauthenticated remote attackers to acce
CVE-2026-49954 HIGH POC
8.6 Jun 15

Authenticated remote code execution in Discuz! X5.0 releases 20260320 through 20260501 allows administrators to chain a

CVE-2026-49768 CRITICAL
9.8 Jun 15

Unauthenticated PHP Object Injection in the Happyforms WordPress plugin (versions <= 1.26.13) allows remote attackers to
CVE-2026-27053 CRITICAL
9.8 Jun 15

Unauthenticated PHP Object Injection in the Broadcast Live Video WordPress plugin (versions prior to 7.1.3) allows remot
CVE-2026-49104 CRITICAL
9.8 Jun 15

Unauthenticated PHP object injection in the WordPress plugin 'Integration for Keap/Infusionsoft and Contact Form 7, WPFo

Share

CVE-2026-34415 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy