CVE-2026-44257

efw4.X is an Enterprise Framework for Web. Prior to 4.08.010, efw.file.FileManager.unZip writes zip entries to disk using new File(baseDir, zipEntry.getName()) with no canonical-path check. An entry name such as ../../../pwned.jsp escapes the intended extraction directory and lands anywhere the Tomcat process can write — including the servlet context root. Combined with the framework's multipart /uploadServlet and an event that calls file.saveUploadFiles + FileManager.unZip, a remote attacker with no credentials drops a JSP webshell and executes arbitrary commands as the Tomcat user. This vulnerability is fixed in 4.08.010.

CVSS

No CVSS.

References

Link	Resource
https://github.com/efwGrp/efw4.X/security/advisories/GHSA-q7jx-7x5r-r9f6
https://github.com/efwGrp/efw4.X/security/advisories/GHSA-q7jx-7x5r-r9f6

Configurations

No configuration.

History

26 Oct 2026, 14:10

Type	Values Removed	Values Added
Summary		(es) efw4.X es un Framework Empresarial para Web. Antes de 4.08.010, efw.file.FileManager.unZip escribe entradas zip al disco usando new File(baseDir, zipEntry.getName()) sin una verificación de ruta canónica. Un nombre de entrada como .. / .. / .. / pwned.jsp escapa del directorio de extracción previsto y aterriza en cualquier lugar donde el proceso de Tomcat pueda escribir - incluyendo la raíz del contexto del servlet. Combinado con el /uploadServlet multipart del framework y un evento que llama a file.saveUploadFiles + FileManager.unZip, un atacante remoto sin credenciales deja caer una webshell JSP y ejecuta comandos arbitrarios como el usuario de Tomcat. Esta vulnerabilidad está corregida en 4.08.010.

Information

Published : 2026-05-12 22:16

Updated : 2026-10-26 14:10

NVD link : CVE-2026-44257

Mitre link : CVE-2026-44257

CVE.ORG link : CVE-2026-44257

JSON object : View

Products Affected

No product.

CWE

CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

{"id": "CVE-2026-44257", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44257", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-05-18T14:56:21.975090Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "efwGrp", "product": "efw4.X", "versions": [{"status": "affected", "version": "< 4.08.010"}]}]}], "published": "2026-05-12T22:16:35.840", "references": [{"url": "https://github.com/efwGrp/efw4.X/security/advisories/GHSA-q7jx-7x5r-r9f6", "source": "security-advisories@github.com"}, {"url": "https://github.com/efwGrp/efw4.X/security/advisories/GHSA-q7jx-7x5r-r9f6", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-77"}]}], "descriptions": [{"lang": "en", "value": "efw4.X is an Enterprise Framework for Web. Prior to 4.08.010, efw.file.FileManager.unZip writes zip entries to disk using new File(baseDir, zipEntry.getName()) with no canonical-path check. An entry name such as ../../../pwned.jsp escapes the intended extraction directory and lands anywhere the Tomcat process can write \u2014 including the servlet context root. Combined with the framework's multipart /uploadServlet and an event that calls file.saveUploadFiles + FileManager.unZip, a remote attacker with no credentials drops a JSP webshell and executes arbitrary commands as the Tomcat user. This vulnerability is fixed in 4.08.010."}, {"lang": "es", "value": "efw4.X es un Framework Empresarial para Web. Antes de 4.08.010, efw.file.FileManager.unZip escribe entradas zip al disco usando new File(baseDir, zipEntry.getName()) sin una verificaci\u00f3n de ruta can\u00f3nica. Un nombre de entrada como .. / .. / .. / pwned.jsp escapa del directorio de extracci\u00f3n previsto y aterriza en cualquier lugar donde el proceso de Tomcat pueda escribir - incluyendo la ra\u00edz del contexto del servlet. Combinado con el /uploadServlet multipart del framework y un evento que llama a file.saveUploadFiles + FileManager.unZip, un atacante remoto sin credenciales deja caer una webshell JSP y ejecuta comandos arbitrarios como el usuario de Tomcat. Esta vulnerabilidad est\u00e1 corregida en 4.08.010."}], "lastModified": "2026-10-26T14:10:00.130", "sourceIdentifier": "security-advisories@github.com"}