The vulnerability in thexerteproject's xerteonlinetoolkits (versions up to 3.15) is due to an incomplete list of disallowed inputs in the elFinder connector endpoint. Specifically, the input validation regex pattern does not block the .php4 extension, which is executable by PHP. Attackers can exploit this by uploading malicious PHP code renamed with the .php4 extension, leveraging authentication bypass and path traversal vulnerabilities to execute arbitrary OS commands on the server without authentication.

Successful exploitation allows unauthenticated attackers to execute arbitrary operating system commands on the affected server, potentially leading to full system compromise. This can result in unauthorized access, data theft, service disruption, or further attacks originating from the compromised server.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the elFinder connector endpoint and monitor for suspicious file uploads. Avoid exposing vulnerable versions publicly and consider applying custom input validation to block PHP-executable extensions including .php4.