# CVE-2026-34415: The Xerte Project Xerte Online Toolkits RCE in elFinder connector

Source: https://junglewise.ai/threats/cve-2026-34415-the-xerte-project-xerte-online-toolkits-rce-in-elfinder-connector  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-22. Updated: 2026-07-14  
License: CC BY 4.0 with a link back

CVE-2026-34415 · Severity: critical · CVSS 9.8 · Published 2026-04-22

Xerte Online Toolkits, an open-source platform for creating interactive learning materials, contains a security flaw in its file management component. An attacker can bypass security checks to upload and execute malicious code on the server. This could allow a remote attacker to take full control of the system, potentially leading to data theft or a complete service outage.

Technologies: [The Xerte Project Xerte Online Toolkits](https://junglewise.ai/threats/technologies/xerte-online-toolkits). Vendors: [The Xerte Project](https://junglewise.ai/threats/vendors/the-xerte-project).

## Quick answers

**Is CVE-2026-34415 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-34415 being exploited in the wild.

**How severe is CVE-2026-34415?** Critical severity, with a CVSS score of 9.8, published 22 April 2026.

**Which products and versions are affected?** The Xerte Project Xerte Online Toolkits <= 3.15.

**Is there a fix for CVE-2026-34415?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-34415 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-34415?** Check whether you run The Xerte Project Xerte Online Toolkits at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Xerte Online Toolkits (<= 3.15) contains an incomplete list of disallowed inputs (CWE-184) in the elFinder connector endpoint (/editor/elfinder/php/connector.php). The regex pattern used to filter file extensions incorrectly allows files with the .php4 extension to be processed. By chaining this with an authentication bypass (CVE-2026-34413) and a path traversal vulnerability (CVE-2026-34414), an unauthenticated remote attacker can upload a malicious file, rename it to use a .php4 extension, and move it to the application root to achieve arbitrary code execution. Patches have been backported to versions 3.13, 3.14, and 3.15.

## Affected products

- The Xerte Project Xerte Online Toolkits <= 3.15

## Timeline

- 2026-03-23: disclosed: Vulnerability reported to developers via GitHub issue
- 2026-04-22: advisory: NVD publication date

## References

- [https://github.com/bootstrapbool/xerteonlinetoolkits-rce](https://github.com/bootstrapbool/xerteonlinetoolkits-rce)
- [https://github.com/thexerteproject/xerteonlinetoolkits/commit/02661be88cc369325ea01b508086bde7fbfec805](https://github.com/thexerteproject/xerteonlinetoolkits/commit/02661be88cc369325ea01b508086bde7fbfec805)
- [https://github.com/thexerteproject/xerteonlinetoolkits/commit/17e4f945fe6a3400fa88c01eda18c1075ee4a212](https://github.com/thexerteproject/xerteonlinetoolkits/commit/17e4f945fe6a3400fa88c01eda18c1075ee4a212)
- [https://github.com/thexerteproject/xerteonlinetoolkits/commit/507d55c5e91bf9310b5b1c7fad8aebfef902ad23](https://github.com/thexerteproject/xerteonlinetoolkits/commit/507d55c5e91bf9310b5b1c7fad8aebfef902ad23)
- [https://github.com/thexerteproject/xerteonlinetoolkits/issues/1527](https://github.com/thexerteproject/xerteonlinetoolkits/issues/1527)
- [https://www.vulncheck.com/advisories/xerte-online-toolkits-file-upload-rce-via-elfinder-connector](https://www.vulncheck.com/advisories/xerte-online-toolkits-file-upload-rce-via-elfinder-connector)
- [https://xerte.org.uk/index.php/en/downloads-1/category/3-xerte-online-toolkits](https://xerte.org.uk/index.php/en/downloads-1/category/3-xerte-online-toolkits)

## Related threats

- [The Xerte Project Xerte Online Toolkits RCE via antivirus binary path configuration](https://junglewise.ai/threats/cve-2026-12116-the-xerte-project-xerte-online-toolkits-rce-via-antivirus-binary)
- [thexerteproject Xerte Online Toolkits path disclosure in setup page](https://junglewise.ai/threats/cve-2026-41459-thexerteproject-xerte-online-toolkits-path-disclosure-in-setup)
- [The Xerte Project Xerte Online Toolkits path traversal in elFinder connector](https://junglewise.ai/threats/cve-2026-34414-the-xerte-project-xerte-online-toolkits-path-traversal-in)
- [The Xerte Project Xerte Online Toolkits auth bypass in elFinder connector](https://junglewise.ai/threats/cve-2026-34413-the-xerte-project-xerte-online-toolkits-auth-bypass-in-elfinder)