efw4.X CVE-2026-44257

Exploitation requires that the efw4.X application (version < 4.08.010) be network-reachable with its multipart /uploadServlet exposed and an event configured that chains file.saveUploadFiles into FileManager.unZip so an uploaded archive is automatically extracted - that upload-then-unzip code path IS the concrete prerequisite. No authentication or user interaction is needed (CVSS PR:N/UI:N), and default extraction has no canonical-path check, so any writable location reachable by the Tomcat process (notably the servlet context root) can receive the payload. Limiting factors: the target must actually deploy the vulnerable unZip-on-upload flow, and the Tomcat process must have write permission to a web-executable directory for the webshell step to yield code execution; instances that do not expose the upload/unzip event, or that run Tomcat with a context root the process cannot write to, materially reduce or block the RCE outcome even though arbitrary file write may still be possible.

The signals are largely aligned toward high but not universally-exploited risk. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, base 9.3) describes network-reachable, low-complexity, unauthenticated exploitation with total confidentiality, integrity, and availability impact, consistent with the description's 'remote attacker with no credentials.' SSVC reinforces prioritization: Exploitation=poc, Automatable=yes, Technical Impact=total - a working proof-of-concept exists and the attack can be scripted at scale. Counterbalancing this, EPSS is low at 0.21% (43rd percentile) and the CVE is NOT on CISA KEV, indicating no confirmed widespread active exploitation yet; the low EPSS most plausibly reflects the product's niche footprint rather than any difficulty of exploitation. Net: technically this is a genuine critical (trivial unauthenticated RCE) and any exposed efw4.X instance is an urgent patch priority, but real-world blast radius is bounded by how few organizations run the framework. No conflict was found between CVSS and description; the only notable mismatch is the CWE classification (CWE-77) versus the actual Zip-Slip file-write mechanism.

A remote, unauthenticated attacker crafts a ZIP archive containing an entry named like ../../../<context-root>/shell.jsp and POSTs it to the framework's public multipart /uploadServlet, triggering an event that calls file.saveUploadFiles then FileManager.unZip. Because unZip performs no canonical-path check, the JSP escapes the extraction directory into the Tomcat-served context root; the attacker then requests shell.jsp and runs arbitrary OS commands as the Tomcat user. A proof-of-concept is reported to exist (SSVC Exploitation=poc) and the attack is automatable (SSVC Automatable=yes), so it can be scripted against exposed instances.