EUVD-2026-29843Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable connector, low complexity, and no auth/UI per the flaw bypassing the protected control (PR:N/UI:N); arbitrary file write/move enables webshell placement and file overwrite, giving high C/I/A.
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
3DescriptionGitHub Advisory
efw4.X is an Enterprise Framework for Web. Prior to 4.08.010, the elfinder_checkRisk function validates target and targets for path traversal and home containment, but does not validate the dst (destination) parameter used by elfinder_paste. An attacker can copy or move files from within the home directory to any arbitrary destination by setting dst to a base64-encoded traversal path. This bypasses the protected=true security control. This vulnerability is fixed in 4.08.010.
AnalysisAI
Arbitrary file relocation in efwGrp's efw4.X Enterprise Framework for Web before 4.08.010 lets remote attackers copy or move files out of the home directory to any location on the host by supplying a base64-encoded traversal path in the elfinder_paste 'dst' parameter. The elfinder_checkRisk routine validates the 'target'/'targets' parameters for traversal and home containment but overlooks 'dst', bypassing the protected=true control. Publicly available exploit code exists (SSVC: PoC), though EPSS is only 0.05% and it is not in CISA KEV.
Technical ContextAI
The affected component is elFinder, a widely-used PHP/JavaScript web file manager, as integrated into the efw4.X framework. elFinder connectors expose file operations (paste = copy/move) over HTTP, taking base64-encoded path parameters. The efw4.X hardening wraps these operations with elfinder_checkRisk, which enforces path-traversal and 'home containment' checks and a protected=true flag. The flaw is an incomplete validation gap: 'target' and 'targets' (the source items) are checked, but 'dst' (the paste destination) is not, so a '../' sequence encoded in base64 escapes the home jail. Although NVD tags this CWE-78 (OS Command Injection), the actual root cause is path traversal (CWE-22) in the destination handling; the tags list both 'Command Injection' and 'Path Traversal', reflecting that arbitrary file placement can be chained toward code execution.
RemediationAI
Upgrade to efw4.X 4.08.010, which adds validation of the 'dst' parameter in elfinder_paste - Vendor-released patch: 4.08.010, per GHSA-9g5w-qw96-jr3x (https://github.com/efwGrp/efw4.X/security/advisories/GHSA-9g5w-qw96-jr3x). If immediate patching is not possible, restrict network access to the elFinder connector endpoint (require authentication / place behind a VPN or IP allowlist), and disable copy/move (paste) capability in the elFinder connector configuration if the deployment does not require it; be aware this breaks legitimate file-relocation workflows. As a stopgap, monitor for and reject requests whose base64-decoded 'dst' parameter contains traversal sequences ('../') at a WAF or reverse proxy, noting that encoding variations may evade naive filters.
Arbitrary file write leading to unauthenticated remote code execution affects efw4.X (Enterprise Framework for Web) prio
Authorization bypass in efw4.X (Enterprise Framework for Web) before 4.08.010 lets an authenticated user defeat the elFi
Stored cross-site scripting in efw4.X's previewServlet allows authenticated low-privilege users to cause arbitrary JavaS
Same weakness CWE-78 – OS Command Injection
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today