Input Validation Flaw in Xerte Online Toolkits by Xerte Project

CVE-2026-34415

What is CVE-2026-34415?

Xerte Online Toolkits versions 3.15 and earlier suffer from an input validation flaw in the elFinder connector endpoint. This vulnerability fails to restrict the upload of PHP-executable files with the .php4 extension, allowing unauthenticated attackers to exploit the system. By leveraging this flaw alongside authentication bypass and path traversal vulnerabilities, malicious actors could upload harmful PHP code, rename it to use the .php4 extension, and execute arbitrary commands on the server, thereby compromising its security. Immediate remediation is advised to secure affected installations.

References