CVE-2026-44260

efw4.X is an Enterprise Framework for Web. Prior to 4.08.010, the readonly flag set on the <efw:elFinder> JSP tag is intended to prevent file modifications. When protected=true, elfinder_checkRisk enforces that the client sends readonly=true (matching the session value), but no event handler checks the readonly value before performing write operations. The flag only controls client-side UI elements (disabling buttons) and response metadata (write: 0, locked: 1). An attacker who sends requests directly (bypassing the UI) can perform all file operations despite readonly=true. This vulnerability is fixed in 4.08.010.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/efwGrp/efw4.X/security/advisories/GHSA-5454-qhrf-vcvh
https://github.com/efwGrp/efw4.X/security/advisories/GHSA-5454-qhrf-vcvh

Configurations

No configuration.

History

26 Oct 2026, 14:10

Type	Values Removed	Values Added
Summary		(es) efw4.X es un Framework Empresarial para Web. Antes de la versión 4.08.010, la bandera readonly establecida en la etiqueta JSP <efw:elFinder> está destinada a prevenir modificaciones de archivos. Cuando protected=true, elfinder_checkRisk impone que el cliente envíe readonly=true (coincidiendo con el valor de la sesión), pero ningún gestor de eventos verifica el valor de readonly antes de realizar operaciones de escritura. La bandera solo controla elementos de la interfaz de usuario del lado del cliente (deshabilitando botones) y metadatos de respuesta (write: 0, locked: 1). Un atacante que envía solicitudes directamente (saltándose la interfaz de usuario) puede realizar todas las operaciones de archivo a pesar de readonly=true. Esta vulnerabilidad está corregida en la versión 4.08.010.

Information

Published : 2026-05-12 22:16

Updated : 2026-10-26 14:10

NVD link : CVE-2026-44260

Mitre link : CVE-2026-44260

CVE.ORG link : CVE-2026-44260

JSON object : View

Products Affected

No product.

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2026-44260", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44260", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-05-13T15:03:54.867112Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "efwGrp", "product": "efw4.X", "versions": [{"status": "affected", "version": "< 4.08.010"}]}]}], "published": "2026-05-12T22:16:36.417", "references": [{"url": "https://github.com/efwGrp/efw4.X/security/advisories/GHSA-5454-qhrf-vcvh", "source": "security-advisories@github.com"}, {"url": "https://github.com/efwGrp/efw4.X/security/advisories/GHSA-5454-qhrf-vcvh", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "efw4.X is an Enterprise Framework for Web. Prior to 4.08.010, the readonly flag set on the <efw:elFinder> JSP tag is intended to prevent file modifications. When protected=true, elfinder_checkRisk enforces that the client sends readonly=true (matching the session value), but no event handler checks the readonly value before performing write operations. The flag only controls client-side UI elements (disabling buttons) and response metadata (write: 0, locked: 1). An attacker who sends requests directly (bypassing the UI) can perform all file operations despite readonly=true. This vulnerability is fixed in 4.08.010."}, {"lang": "es", "value": "efw4.X es un Framework Empresarial para Web. Antes de la versi\u00f3n 4.08.010, la bandera readonly establecida en la etiqueta JSP <efw:elFinder> est\u00e1 destinada a prevenir modificaciones de archivos. Cuando protected=true, elfinder_checkRisk impone que el cliente env\u00ede readonly=true (coincidiendo con el valor de la sesi\u00f3n), pero ning\u00fan gestor de eventos verifica el valor de readonly antes de realizar operaciones de escritura. La bandera solo controla elementos de la interfaz de usuario del lado del cliente (deshabilitando botones) y metadatos de respuesta (write: 0, locked: 1). Un atacante que env\u00eda solicitudes directamente (salt\u00e1ndose la interfaz de usuario) puede realizar todas las operaciones de archivo a pesar de readonly=true. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 4.08.010."}], "lastModified": "2026-10-26T14:10:00.130", "sourceIdentifier": "security-advisories@github.com"}