CVE-2026-34415
Incomplete Input Validation in Xerte elFinder Enables Remote Code Execution
Publication date: 2026-04-22
Last updated on: 2026-04-24
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| xerte_online_toolkits | xerte_online_toolkits | to 3.15 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-184 | The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in Xerte Online Toolkits versions 3.15 and earlier. It is caused by incomplete input validation in the elFinder connector endpoint, which fails to block PHP-executable file extensions such as .php4 due to an incorrect regex pattern.
Unauthenticated attackers can exploit this flaw by combining it with authentication bypass and path traversal vulnerabilities to upload malicious PHP code. They can then rename the uploaded file with a .php4 extension and execute arbitrary operating system commands on the server.
How can this vulnerability impact me? :
This vulnerability can have severe impacts as it allows unauthenticated attackers to execute arbitrary operating system commands on the affected server.
- Attackers can upload and execute malicious PHP code remotely.
- It can lead to full system compromise, data theft, or destruction.
- The vulnerability has a high severity score (CVSS v3.1 BaseScore 9.8), indicating critical risk.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows unauthenticated attackers to execute arbitrary operating system commands on the affected server by uploading and executing malicious PHP code. This can lead to unauthorized access, data breaches, and potential compromise of sensitive information.
Such unauthorized access and potential data breaches can negatively impact compliance with common standards and regulations like GDPR and HIPAA, which require protection of personal and sensitive data against unauthorized access and ensure system integrity and confidentiality.
Therefore, if exploited, this vulnerability could result in violations of these regulations due to failure to adequately protect data and systems.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection of this vulnerability involves checking if your system is running Xerte Online Toolkits version 3.15.0 or earlier, especially versions before the specified commits that patched the issue.
You can also monitor for suspicious file uploads with PHP-executable extensions such as ".php4" on the elFinder connector endpoint, which is vulnerable to incomplete input validation.
Network detection might include monitoring HTTP requests to the elFinder connector endpoint for attempts to upload or rename files with ".php4" extensions.
Suggested commands to help detect the vulnerability or exploitation attempts include:
- Use web server access logs to search for requests to the elFinder connector endpoint with ".php4" file uploads or renames, for example: `grep ".php4" /var/log/apache2/access.log`
- Check for presence of suspicious files with ".php4" extensions in the web root or upload directories: `find /var/www/html -name "*.php4"`
- Use network monitoring tools or IDS/IPS to detect HTTP POST requests to the elFinder connector endpoint that include file uploads or path traversal patterns.
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to apply the patches provided for Xerte Online Toolkits versions 3.15, 3.14, and 3.13 that fix the incomplete input validation vulnerability in the elFinder connector endpoint.
If patching is not immediately possible, consider restricting access to the elFinder connector endpoint to trusted users or internal networks only.
Additionally, implement web application firewall (WAF) rules to block file uploads with PHP-executable extensions such as ".php4" and monitor for suspicious activity.
Review and harden file upload validation mechanisms to ensure that disallowed file extensions cannot be uploaded or executed.