CVE-2026-34415

CRITICAL

Xerte Online Toolkits versions 3.15 and earlier contain an incomplete input validation vulnerability in the elFinder connector endpoint that fails to block PHP-executable extensions .php4 due to an...

Affects 0 products across 2 vendors.

CVSS 3.19.8
CVSS v49.3
EPSS4.4%
Percentile91th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, no user interaction needed, impact contained to the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
CWE Weakness Definitions
CWE-184: CWE-184
Related Attack Patterns (CAPEC)
CAPEC-3 Using Leading 'Ghost' Character Sequences to Bypass Input Filters
via CWE-184
CAPEC-43 Exploiting Multiple Input Interpretation Layers
via CWE-184
CAPEC-71 Using Unicode Encoding to Bypass Validation Logic
via CWE-184
CAPEC-85 AJAX Footprinting
via CWE-184
CAPEC-120 Double Encoding
via CWE-184
Show all 9

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

Xerte Online Toolkits versions 3.15 and earlier are vulnerable to an incomplete input validation flaw in the elFinder connector, allowing unauthenticated attackers to upload and execute malicious PHP code.

BSID: BS-2026-GLOBAL-188986-C • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2026-34415?
Xerte Online Toolkits versions 3.15 and earlier are vulnerable to an incomplete input validation flaw in the elFinder connector, allowing unauthenticated attackers to upload and execute malicious PHP code.
What is the CVSS score for CVE-2026-34415?
CVE-2026-34415 has CVSS 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS: 4.4%.
Is CVE-2026-34415 actively exploited?
No confirmed active exploitation of CVE-2026-34415 as of 2026-07-15.
How do I remediate CVE-2026-34415?
Priority: IMMEDIATE.
What systems are affected by CVE-2026-34415?
CVE-2026-34415 affects Block; Xerte.
Vulnerability Details
CVE IDCVE-2026-34415
BSIDBS-2026-GLOBAL-188986-C BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published2026-04-22
Last Modified2026-07-14
ICS Relevance0%
Weakness (CWE)
CWE-184
SourceNVD
Official Description

Xerte Online Toolkits versions 3.15 and earlier contain an incomplete input validation vulnerability in the elFinder connector endpoint that fails to block PHP-executable extensions .php4 due to an incorrect regex pattern. Unauthenticated attackers can exploit this flaw combined with authentication bypass and path traversal vulnerabilities to upload malicious PHP code, rename it with a .php4 extension, and execute arbitrary operating system commands on the server.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

The vulnerability stems from an incorrect regex pattern in the elFinder connector that fails to block PHP-executable extensions such as .php4. This can be exploited in conjunction with authentication bypass and path traversal vulnerabilities to upload and execute malicious PHP code on the server.

Exploitation Likelihood: CRITICAL

Affected Products
VendorProductAffected Versions
Block — —
Xerte — —
Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 176 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
SHA-512 Audit Hasheb20db30e083f59ae61e133ae8a10802de8fddf2e387e85e6e7a95d46f3fc868a0c63e6baa7c00a97d2ec7e14295dcad86dd3b7ceca98a159aab3ef93872411a
Related CVEs affecting Block
CVE-2025-65108 10.0 md-to-pdf is a CLI tool for converting Markdown files to PDF using Node.js an... CVE-2026-25345 9.9 Improper Validation of Specified Quantity in Input vulnerability in GalleryCr... CVE-2024-8672 9.9 The Widget Options – The #1 WordPress Widget & Block Control Plugin plugin fo... CVE-2025-68794 9.8 In the Linux kernel, the following vulnerability has been resolved: iomap: a... CVE-2026-48172 9.8 LiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (po...
View all Block CVEs →

Critical Severity - Know Your Exposure

A CVSS 9.8 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.

Create a free account →