Xerte Online Toolkits versions 3.15 and earlier contain an incomplete input validation vulnerability in the elFinder connector endpoint that fails to block PHP-executa…

Code

The project this record applies to. Exploit listings stay in References.

• Repository · github.com
• Repository · github.com

Timeline

Detection, updates, and resolution for this record.

1. Apr 22, 2026 · NIST NVD

   Detected

   Xerte Online Toolkits versions 3.15 and earlier contain an incomplete input validation vulnerability in the elFinder connector endpoint that fails to block PHP-executable extensions .php4 due to an incorrect regex pattern. Unauthenticated attackers can exploit this flaw combined with authentication bypass and path traversal vulnerabilities to upload malicious PHP code, rename it with a .php4 exten

2. Jul 14, 2026 · NIST NVD

   Updated

   Xerte Online Toolkits versions 3.15 and earlier contain an incomplete input validation vulnerability in the elFinder connector endpoint that fails to block PHP-executable extensions .php4 due to an incorrect regex pattern. Unauthenticated attackers can exploit this flaw combined with authentication bypass and path traversal vulnerabilities to upload malicious PHP code, rename it with a .php4 exten

Sources

• CVE.orgVulnerability recordCVE-2026-34415

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-34415

  Xerte Online Toolkits versions 3.15 and earlier contain an incomplete input validation vulnerability in the elFinder connector endpoint that fails to block PHP-executable extensions .php4 due to an incorrect regex pattern. Unauthenticated attackers can exploit this flaw combined

  nvd.nist.gov

References

• Reference · github.com
• Reference · github.com
• Reference · github.com
• Reference · github.com
• Reference · github.com
• Reference · vulncheck.com
• Reference · xerte.org.uk
• Reference · xerte.org.uk