VULNERABILITY INTELLIGENCE
CVE-2026-44258
EPSS probability0.36%
CISA KEVNot currently listed
Published2026-05-12
Last modified2026-10-26
Description
efw4.X is an Enterprise Framework for Web. Prior to 4.08.010, the elfinder_checkRisk function validates target and targets for path traversal and home containment, but does not validate the dst (destination) parameter used by elfinder_paste. An attacker can copy or move files from within the home directory to any arbitrary destination by setting dst to a base64-encoded traversal path. This bypasses the protected=true security control. This vulnerability is fixed in 4.08.010.
Weakness classification
- security-advisories@github.com: CWE-78