CVE-2026-34415— Xerte Online Toolkits File Upload RCE via elfinder Connector
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-34415
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Xerte Online Toolkits File Upload RCE via elfinder Connector
Source: NVD (National Vulnerability Database)
Vulnerability Description
Xerte Online Toolkits versions 3.15 and earlier contain an incomplete input validation vulnerability in the elFinder connector endpoint that fails to block PHP-executable extensions .php4 due to an incorrect regex pattern. Unauthenticated attackers can exploit this flaw combined with authentication bypass and path traversal vulnerabilities to upload malicious PHP code, rename it with a .php4 extension, and execute arbitrary operating system commands on the server.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
不完整的黑名单
Source: NVD (National Vulnerability Database)
Vulnerability Title
Xerte Online Toolkits 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Xerte Online Toolkits是英国Xerte公司的一个在线学习内容制作平台。 Xerte Online Toolkits 3.15及之前版本存在安全漏洞，该漏洞源于elFinder连接器端点输入验证不完整，未能阻止.php4等PHP可执行扩展，未经身份验证的攻击者可利用此缺陷结合身份验证绕过和路径遍历漏洞上传恶意PHP代码，将其重命名为.php4扩展，并在服务器上执行任意操作系统命令。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Shenlong Deep Dive — AI Deep Analysis
10-question deep dive: root cause, exploitation, mitigation, urgency. Read summary free, full version requires login.
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| thexerteproject | xerteonlinetoolkits | 3.15.0 | - |
II. Public POCs for CVE-2026-34415
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-34415
Please Login to view more intelligence information
Same Patch Batch · thexerteproject · 2026-04-22 · 4 CVEs total
| CVE-2026-34413 | 8.6 HIGH | Xerte Online Toolkits Missing Authentication via connector.php |
| CVE-2026-34414 | 7.1 HIGH | Xerte Online Toolkits Path Traversal via connector.php |
| CVE-2026-41459 | 5.3 MEDIUM | Xerte Online Toolkits Path Disclosure via /setup |
IV. Related Vulnerabilities
Same weakness: CWE-184
- CVE-2026-44115
OpenClaw < 2026.4.22 - Shell Expansion Bypass in Unquoted He - CVE-2026-44114
OpenClaw < 2026.4.20 - Environment Variable Namespace Collis - CVE-2026-43584
OpenClaw < 2026.4.10 - Insufficient Environment Variable Den - CVE-2026-43578
OpenClaw 2026.3.31 < 2026.4.10 - Privilege Escalation via Mi - CVE-2026-41934
Vvveb < 1.0.8.2 Authenticated RCE via Code Editor
V. Comments for CVE-2026-34415
No comments yet