CVE-2026-44258
CriticalSummary
In versions prior to 4.08.010, the elfinder_checkRisk function in efw4.X does not validate the dst parameter used by elfinder_paste, allowing an attacker to copy or move files from the home directory to any arbitrary location by setting dst to a base64-encoded traversal path.
Risk Assessment
An attacker can gain access to files in the home directory, potentially leading to data leakage or unauthorized access to the system.
Recommendation
It is recommended to upgrade to version 4.08.010 or later to mitigate this vulnerability.
Original NVD description (English source)
efw4.X is an Enterprise Framework for Web. Prior to 4.08.010, the elfinder_checkRisk function validates target and targets for path traversal and home containment, but does not validate the dst (destination) parameter used by elfinder_paste. An attacker can copy or move files from within the home directory to any arbitrary destination by setting dst to a base64-encoded traversal path. This bypasses the protected=true security control. This vulnerability is fixed in 4.08.010.