Is CVE-2026-34415 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-34415 being exploited in the wild.

How severe is CVE-2026-34415?

Critical severity, with a CVSS score of 9.8, published 22 April 2026.

Which products and versions are affected?

The Xerte Project Xerte Online Toolkits <= 3.15.

Is there a fix for CVE-2026-34415?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-34415 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-34415?

Check whether you run The Xerte Project Xerte Online Toolkits at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-34415: The Xerte Project Xerte Online Toolkits RCE in elFinder connector

Q: Is there a fix for CVE-2026-34415?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-34415 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-34415?

Check whether you run The Xerte Project Xerte Online Toolkits at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-34415 · Severity: critical · CVSS 9.8 · Published 2026-04-22

Xerte Online Toolkits, an open-source platform for creating interactive learning materials, contains a security flaw in its file management component. An attacker can bypass security checks to upload and execute malicious code on the server. This could allow a remote attacker to take full control of the system, potentially leading to data theft or a complete service outage.

Technologies: The Xerte Project Xerte Online Toolkits. Vendors: The Xerte Project.

Quick answers

Is CVE-2026-34415 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-34415 being exploited in the wild.
How severe is CVE-2026-34415?: Critical severity, with a CVSS score of 9.8, published 22 April 2026.
Which products and versions are affected?: The Xerte Project Xerte Online Toolkits <= 3.15.
Is there a fix for CVE-2026-34415?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-34415 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-34415?: Check whether you run The Xerte Project Xerte Online Toolkits at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Xerte Online Toolkits (<= 3.15) contains an incomplete list of disallowed inputs (CWE-184) in the elFinder connector endpoint (/editor/elfinder/php/connector.php). The regex pattern used to filter file extensions incorrectly allows files with the .php4 extension to be processed. By chaining this with an authentication bypass (CVE-2026-34413) and a path traversal vulnerability (CVE-2026-34414), an unauthenticated remote attacker can upload a malicious file, rename it to use a .php4 extension, and move it to the application root to achieve arbitrary code execution. Patches have been backported to versions 3.13, 3.14, and 3.15.

Affected products

The Xerte Project Xerte Online Toolkits <= 3.15

Timeline

2026-03-23: disclosed: Vulnerability reported to developers via GitHub issue
2026-04-22: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.