Which versions of efw4.X are affected by CVE-2026-44257?

efw Enterprise Framework for Web versions prior to 4.08.010 contain an unauthenticated remote code execution vulnerability via Zip Slip in file extraction; publicly available exploit code exists.. A patch is available.

How to fix or mitigate CVE-2026-44257?

Within 24 hours, inventory all systems running efw 4.X and identify which are internet-facing or accessible from untrusted networks; verify current network segmentation and web application firewall coverage for the /uploadServlet endpoint. Within 7 days, apply vendor patch efw 4.08.010 to all affected systems following change control procedures, prioritizing internet-facing instances. Within 30 days, verify patch deployment across all systems through version confirmation; review Tomcat servlet context and access logs for indicators of exploitation attempts (suspicious ZIP uploads, unauthorized JSP file creation in servlet root) and confirm no webshells were deployed during the patching window.

efw4.X CVE-2026-44257

Q: What is the CVSS score of CVE-2026-44257?

CVE-2026-44257 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-29842 CRITICAL

Command Injection (CWE-77)

2026-05-12 GitHub_M

Command Injection Tomcat Canonical Efw4 X

9.3

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Unauthenticated network upload with no user interaction (AV:N/AC:L/PR:N/UI:N); webshell yields full command execution as the Tomcat user, so C:H/I:H/A:H, scope unchanged as impact stays within the host security authority.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 19:19 vuln.today

Patch available

May 12, 2026 - 22:03 EUVD

CVE Published

May 12, 2026 - 21:06 nvd

CRITICAL 9.3

DescriptionGitHub Advisory

efw4.X is an Enterprise Framework for Web. Prior to 4.08.010, efw.file.FileManager.unZip writes zip entries to disk using new File(baseDir, zipEntry.getName()) with no canonical-path check. An entry name such as ../../../pwned.jsp escapes the intended extraction directory and lands anywhere the Tomcat process can write - including the servlet context root. Combined with the framework's multipart /uploadServlet and an event that calls file.saveUploadFiles + FileManager.unZip, a remote attacker with no credentials drops a JSP webshell and executes arbitrary commands as the Tomcat user. This vulnerability is fixed in 4.08.010.

AnalysisAI

Arbitrary file write leading to unauthenticated remote code execution affects efw4.X (Enterprise Framework for Web) prior to 4.08.010, where efw.file.FileManager.unZip extracts ZIP entries via new File(baseDir, zipEntry.getName()) with no canonical-path validation - a classic Zip Slip. By combining the framework's public multipart /uploadServlet with an event that chains file.saveUploadFiles and FileManager.unZip, an attacker with no credentials can plant a JSP webshell in the Tomcat servlet context root and execute OS commands as the Tomcat user. Publicly available exploit code exists (SSVC lists proof-of-concept); the flaw is not on CISA KEV and EPSS is low (0.21%, 43rd percentile).

Technical ContextAI

The affected component is efw4.X, a Java Enterprise Framework for Web (vendor efwGrp) deployed as a Tomcat servlet application, per CPE cpe:2.3:a:efwgrp:efw4.x. The root cause is unsafe archive extraction: FileManager.unZip resolves each ZIP entry name relative to a base directory using new File(baseDir, zipEntry.getName()) and never compares the resolved canonical path against the intended extraction root. A malicious entry name containing traversal sequences (e.g. ../../../pwned.jsp) escapes the extraction directory and is written anywhere the Tomcat process can write, including the web-accessible context root. Although NVD tags this CWE-77 (Command Injection) - reflecting the ultimate code-execution impact and the 'Command Injection' tag - the underlying defect is more precisely a path-traversal / Zip-Slip arbitrary file write (CWE-22/CWE-29) leveraged for execution by writing an executable JSP. The 'Tomcat' and 'Canonical' tags confirm the servlet-container context and the missing canonical-path check as the crux of the bug.

RemediationAI

Vendor-released patch: 4.08.010 - upgrade efw4.X to 4.08.010 or later, which adds the canonical-path check to FileManager.unZip and closes the traversal write; follow the vendor advisory at https://github.com/efwGrp/efw4.X/security/advisories/GHSA-q7jx-7x5r-r9f6. If immediate patching is not possible, restrict or authenticate access to the /uploadServlet endpoint at a reverse proxy or WAF so unauthenticated multipart uploads cannot reach the framework (trade-off: breaks any legitimate anonymous upload workflow); disable or remove any event flow that chains saveUploadFiles into FileManager.unZip so untrusted archives are never auto-extracted (cost: loses that upload/unzip feature); and tighten filesystem permissions so the Tomcat process user cannot write to the servlet context root or other web-executable directories (prevents webshell drop but may break features that legitimately write into the webapp). As a detection aid, monitor the context root for newly created .jsp files, and after patching audit for any already-planted JSP files, since a prior compromise persists across the upgrade.