CVE-2026-34415

Critical

Description

Xerte Online Toolkits versions 3.15 and earlier contain an incomplete input validation vulnerability in the elFinder connector endpoint that fails to block PHP-executable extensions .php4 due to an incorrect regex pattern. Unauthenticated attackers can exploit this flaw combined with authentication bypass and path traversal vulnerabilities to upload malicious PHP code, rename it with a .php4 extension, and execute arbitrary operating system commands on the server.

SeverityCritical

CVSS9.8

Exploit probability—

ProductThexerteproject Xerteonlinetoolkits

PublishedApr 22, 2026

First seenApr 22, 2026

Weakness typeCWE-184CWE-184

How to fix

Patches

Vendor advisories

xerte.org.uk/xertetoolkits_3.15_ChangeLog.html

Affected products

Product	Affected versions	Fixed in
thexerteproject xerteonlinetoolkits	v ≤ 3.15.0	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.