← Voltar para CVEs
CVE-2026-34415
CRITICAL9.8
Descricao
Xerte Online Toolkits versions 3.15 and earlier contain an incomplete input validation vulnerability in the elFinder connector endpoint that fails to block PHP-executable extensions .php4 due to an incorrect regex pattern. Unauthenticated attackers can exploit this flaw combined with authentication bypass and path traversal vulnerabilities to upload malicious PHP code, rename it with a .php4 extension, and execute arbitrary operating system commands on the server.
Detalhes CVE
Pontuacao CVSS v3.19.8
SeveridadeCRITICAL
Vetor CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vetor de ataqueNETWORK
ComplexidadeLOW
Privilegios necessariosNONE
Interacao do usuarioNONE
Publicado4/22/2026
Ultima modificacao4/22/2026
Fontenvd
Avistamentos honeypot0
Fraquezas (CWE)
CWE-184
Referencias
https://github.com/thexerteproject/xerteonlinetoolkits/commit/02661be88cc369325ea01b508086bde7fbfec805(disclosure@vulncheck.com)
https://github.com/thexerteproject/xerteonlinetoolkits/commit/17e4f945fe6a3400fa88c01eda18c1075ee4a212(disclosure@vulncheck.com)
https://github.com/thexerteproject/xerteonlinetoolkits/commit/507d55c5e91bf9310b5b1c7fad8aebfef902ad23(disclosure@vulncheck.com)
https://github.com/thexerteproject/xerteonlinetoolkits/issues/1527(disclosure@vulncheck.com)
https://www.vulncheck.com/advisories/xerte-online-toolkits-file-upload-rce-via-elfinder-connector(disclosure@vulncheck.com)
https://xerte.org.uk/index.php/en/downloads-1/category/3-xerte-online-toolkits(disclosure@vulncheck.com)
https://xerte.org.uk/xertetoolkits_3.15_ChangeLog.html(disclosure@vulncheck.com)
Correlacoes IOC
Sem correlacoes registradas
This product uses data from the NVD API but is not endorsed or certified by the NVD.