CVE-2026-34415

CVE-2026-34415 is a critical input validation vulnerability affecting Xerte Online Toolkits version 3.15 and earlier in the elFinder connector endpoint. The flaw allows unauthenticated attackers to bypass file upload restrictions by exploiting an incomplete regex pattern that fails to block the .php4 executable extension. When combined with authentication bypass and path traversal weaknesses, attackers can upload malicious PHP code, rename it with a .php4 extension, and execute arbitrary operating system commands on vulnerable servers. The vulnerability carries a CVSS 3.1 severity score of 9.8 (CRITICAL) with a network-based attack vector requiring no authentication or user interaction, resulting in complete compromise of system confidentiality, integrity, and availability. The attack complexity is low, making exploitation straightforward for threat actors with basic technical knowledge. While CVE-2026-34415 is not currently listed in CISA's Known Exploited Vulnerabilities catalog, it is flagged as active on vulnerability hotlists and represents a significant risk requiring immediate patching. Organizations running affected Xerte versions should prioritize remediation given the critical severity rating and the remote, unauthenticated nature of the attack vector.