Path traversal via unchecked dst parameter in efw4.X (CVE-2026-44258)

The elfinder_checkRisk function in efw4.X validates source path parameters (target and targets) for path traversal, but does not validate the dst (destination) parameter used by elfinder_paste. An attacker can supply a base64-encoded traversal path as dst to copy or move files to arbitrary locations outside the home directory, bypassing the protected=true security control. This can lead to remote code execution by copying a staged webshell to the webapp root. Affected versions: - <= 4.08.009 We recommend updating to: 4.08.010. CVSS 9.3 · our assessment: act_now Reference: https://github.com/efwGrp/efw4.X/security/advisories/GHSA-9g5w-qw96-jr3x Details: https://vuln.today/cve/CVE-2026-44258