CVE-2026-34415 json
Xerte Online Toolkits File Upload RCE via elfinder Connector
published 6mo ago modified 14d ago also EUVD-2026-25069
- cvss
- 9.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 3.6%
- EPSS 3.6% chance of exploitation in 30 days, percentile 89%
- public exploits
- 1
- Metasploit
Summary
Xerte Online Toolkits versions 3.15 and earlier contain an incomplete input validation vulnerability in the elFinder connector endpoint that fails to block PHP-executable extensions .php4 due to an incorrect regex pattern. Unauthenticated attackers can exploit this flaw combined with authentication bypass and path traversal vulnerabilities to upload malicious PHP code, rename it with a .php4 extension, and execute arbitrary operating system commands on the server.
Patch / fix
- apereo xerte_online_toolkits 3.15.5
Is CVE-2026-34415 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerTimeline
- First public exploit (Metasploit exploit/multi/http/xerte_unauthenticated_mediaupload)
- Published
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 6mo ago
Exploit prediction
3.58% chance of exploitation in the next 30 days, higher than 89% of all scored CVEs (FIRST EPSS, 2026-11-09).
Exploits and checks
- Metasploit exploit/multi/http/xerte_unauthenticated_mediaupload Xerte Online Toolkits Arbitrary File Upload - Unauthenticated Media Upload metasploit exploit, excellent rank, 2026-04-22
- github.com https://github.com/bootstrapbool/xerteonlinetoolkits-rce referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 9.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
| CNA | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CNA | 4.0 | 9.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected products
- thexerteproject xerteonlinetoolkits
Classification
- Weakness
-
- CWE-184 Incomplete List of Disallowed Inputs
References
-
github.com
/thexerteproject/xerteonlinetoolkits/commit/02661be88cc369325ea01b508086bde7fbfec805
patch
-
github.com
/thexerteproject/xerteonlinetoolkits/commit/17e4f945fe6a3400fa88c01eda18c1075ee4a212
patch
-
github.com
/thexerteproject/xerteonlinetoolkits/commit/507d55c5e91bf9310b5b1c7fad8aebfef902ad23
patch
-
github.com
/bootstrapbool/xerteonlinetoolkits-rce
technical-description, exploit
-
xerte.org.uk
/xertetoolkits_3.15_ChangeLog.html
release-notes
-
xerte.org.uk
/index.php/en/downloads-1/category/3-xerte-online-toolkits
product, permissions-required
-
github.com
/thexerteproject/xerteonlinetoolkits/issues/1527
issue-tracking
-
vulncheck.com
/advisories/xerte-online-toolkits-file-upload-rce-via-elfinder-connector
third-party-advisory
Sources
- CVE List CVE-2026-34415
- NVD CVE-2026-34415
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.