Which versions of Xerte Online Toolkits are affected by EUVD-2026-25069?

Xerte Online Toolkits versions 3.15 and earlier contain a critical remote code execution vulnerability allowing unauthenticated attackers to upload and execute arbitrary code on affected servers,…. A patch is available.

Is there a public PoC exploit available for EUVD-2026-25069?

Yes, a public proof-of-concept exploit is available for EUVD-2026-25069. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate EUVD-2026-25069?

Within 24 hours: Identify all Xerte Online Toolkits instances in your environment and confirm versions (target versions 3.15 and earlier). Within 7 days: Apply vendor-released patches via GitHub commits 02661be, 17e4f94, or 507d55c, or upgrade to patched release version. Implement network-level access controls restricting direct internet access to Xerte elFinder connector endpoints (/elFinder) if immediate patching is blocked. Within 30 days: Conduct forensic analysis of upload directories and PHP execution logs for indicators of compromise; audit file systems for suspicious .php4 files or recently modified PHP files; review access logs for exploitation attempts.

Xerte Online Toolkits EUVD-2026-25069

Q: What is the CVSS score of EUVD-2026-25069?

EUVD-2026-25069 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

| CVE-2026-34415 CRITICAL

Incomplete List of Disallowed Inputs (CWE-184)

2026-04-22 VulnCheck

PHP Authentication Bypass Path Traversal Xerteonlinetoolkits

9.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulnCheck) · only source for this CVE.

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 20:22 vuln.today

cvss_changed

Analysis Generated

Apr 23, 2026 - 06:44 vuln.today

CVSS changed

Apr 22, 2026 - 19:22 NVD

9.8 (CRITICAL) 9.3 (CRITICAL)

EUVD ID Assigned

Apr 22, 2026 - 19:01 euvd

EUVD-2026-25069

Analysis Generated

Apr 22, 2026 - 19:01 vuln.today

Patch released

Apr 22, 2026 - 19:01 nvd

Patch available

CVE Published

Apr 22, 2026 - 18:33 nvd

CRITICAL 9.3

DescriptionCVE.org

Xerte Online Toolkits versions 3.15 and earlier contain an incomplete input validation vulnerability in the elFinder connector endpoint that fails to block PHP-executable extensions .php4 due to an incorrect regex pattern. Unauthenticated attackers can exploit this flaw combined with authentication bypass and path traversal vulnerabilities to upload malicious PHP code, rename it with a .php4 extension, and execute arbitrary operating system commands on the server.

AnalysisAI

Remote code execution in Xerte Online Toolkits 3.15 and earlier allows unauthenticated attackers to upload and execute arbitrary PHP code by chaining an incomplete file extension filter bypass (.php4 extension) with authentication bypass and path traversal vulnerabilities in the elFinder connector endpoint. Attackers can achieve complete server compromise by uploading malicious PHP files, renaming them with the .php4 extension to evade filtering, and executing operating system commands. Vendor-released patches available via three GitHub commits (02661be, 17e4f94, 507d55c). No public exploit code or active exploitation confirmed at time of analysis, though the attack chain is straightforward for skilled attackers.

Technical ContextAI

This vulnerability affects the elFinder file manager connector integration in Xerte Online Toolkits, an open-source e-learning authoring platform. The root cause is CWE-184 (Incomplete List of Disallowed Inputs), where the input validation regex pattern fails to block legacy PHP extensions like .php4, .php5, and .phtml that Apache and other web servers may still execute as PHP code. The elFinder connector is a server-side component that handles file upload, rename, and management operations. When combined with authentication bypass flaws (allowing unauthenticated access to the connector) and path traversal issues (enabling file placement in web-accessible directories), attackers can bypass the incomplete extension filter by uploading a file with a safe extension, then renaming it to .php4 post-upload. The affected product CPE (cpe:2.3:a:thexerteproject:xerteonlinetoolkits) confirms this impacts the main Xerte Online Toolkits application across versions 3.15 and earlier.

RemediationAI

Immediately upgrade to Xerte Online Toolkits version incorporating all three security patches (commits 02661be, 17e4f94, 507d55c available at https://github.com/thexerteproject/xerteonlinetoolkits). While no specific post-3.15 version number is confirmed in available data, the patches address the incomplete regex validation, authentication bypass, and path traversal components of the exploit chain. Download patched releases from https://xerte.org.uk/index.php/en/downloads-1/category/3-xerte-online-toolkits and verify commit hashes match the security fixes. If immediate patching is impossible, implement these compensating controls with noted trade-offs: (1) Block all external access to /elfinder/connectors/ paths via web server or firewall rules - this breaks file upload functionality for legitimate users but prevents unauthenticated exploitation; (2) Configure Apache/PHP-FPM to explicitly deny execution of .php4, .php5, and .phtml extensions via AddHandler directives or php_admin_flag engine off for these extensions - this mitigates RCE but does not address the underlying auth bypass or path traversal; (3) Restrict Xerte installation to internal networks only with VPN-enforced access - reduces attack surface but does not eliminate risk from insider threats or compromised internal systems. After patching, audit server directories for suspicious .php4/.php5 files uploaded during the vulnerability window and review web server access logs for POST requests to elfinder connector endpoints from unexpected sources.