CVE-2026-44259
MediumCVSS 4.6Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
Prior to 4.08.010, the previewServlet in efw4.X serves files with their detected MIME type based on file extension, without any content sanitization or security headers. Files with .html, .htm, or .svg extensions are served as text/html or image/svg+xml respectively, causing any embedded JavaScript to execute in the victim's browser within the application's origin.
Risk Assessment
An attacker can deliver a malicious file that, when opened, executes JavaScript in the application's origin, leading to XSS. This may result in session data theft or account takeover.
Recommendation
Update efw4.X to version 4.08.010 or later. Consider enforcing a Content-Disposition: attachment header for served files.
Other vulnerabilities in efw4.X
See all- CVE-2026-44258Critical
In versions prior to 4.08.010, the elfinder_checkRisk function in efw4.X does not validate the dst parameter used by elfinder_paste, allowing an attacker to copy or move files from the home directory to any arbitrary location by setting dst to a base64-encoded traversal path.
- CVE-2026-44257Critical
In efw4.X prior to version 4.08.010, the efw.file.FileManager.unZip method did not check the canonical path when writing zip entries to disk, allowing for directory traversal. An attacker could exploit this vulnerability to drop a malicious JSP file and execute arbitrary commands as the Tomcat user.
- CVE-2026-44260High
In versions prior to 4.08.010 of the efw4.X framework, the readonly flag set on the <efw:elFinder> JSP tag was intended to prevent file modifications. However, the lack of proper event handlers allows attackers to perform write operations by bypassing the user interface.
Original NVD description (English source)
efw4.X is an Enterprise Framework for Web. Prior to 4.08.010, the previewServlet serves files with their detected MIME type based on file extension, without any content sanitization or security headers. Files with .html, .htm, or .svg extensions are served as text/html or image/svg+xml respectively, causing any embedded JavaScript to execute in the victim's browser within the application's origin. This vulnerability is fixed in 4.08.010.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS