Zip slip remote code execution in efw4.X (CVE-2026-44257)

efw.file.FileManager.unZip extracts zip entries without validating canonical paths, allowing directory traversal via crafted entry names such as `../../../pwned.jsp`. Combined with the framework's multipart /uploadServlet, an unauthenticated remote attacker can write a JSP webshell to the servlet context root and execute arbitrary commands as the Tomcat process user. Affected versions: - <= 4.08.009 We recommend updating to: 4.08.010. CVSS 9.3 · our assessment: act_now Reference: https://github.com/efwGrp/efw4.X/security/advisories/GHSA-q7jx-7x5r-r9f6 Details: https://vuln.today/cve/CVE-2026-44257