EUVD-2026-29844Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Network delivery via web, low-privilege upload account required, victim must preview file; scope unchanged as XSS is contained within application origin with no availability impact.
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
3DescriptionGitHub Advisory
efw4.X is an Enterprise Framework for Web. Prior to 4.08.010, the previewServlet serves files with their detected MIME type based on file extension, without any content sanitization or security headers. Files with .html, .htm, or .svg extensions are served as text/html or image/svg+xml respectively, causing any embedded JavaScript to execute in the victim's browser within the application's origin. This vulnerability is fixed in 4.08.010.
AnalysisAI
Stored cross-site scripting in efw4.X's previewServlet allows authenticated low-privilege users to cause arbitrary JavaScript execution in victims' browsers by uploading .html, .htm, or .svg files that are served without sanitization or protective security headers. All efw4.X versions prior to 4.08.010 are affected; the framework serves these files with text/html or image/svg+xml MIME types derived from extension alone, giving browsers a green light to parse and execute embedded scripts within the application's origin. No active exploitation confirmed in CISA KEV, but SSVC data confirms a POC exists; EPSS at 0.03% (8th percentile) reflects low opportunistic exploitation probability consistent with the authentication and user-interaction requirements.
Technical ContextAI
efw4.X (CPE: cpe:2.3:a:efwgrp:efw4.x:*:*:*:*:*:*:*:*) is an enterprise Java web framework published by efwGrp. The vulnerability is rooted in CWE-80 (Improper Neutralization of Script-Related HTML Tags in a Web Page): the previewServlet resolves MIME types purely from file extension - .html/.htm map to text/html and .svg maps to image/svg+xml - and then streams the file body to the browser without setting any sanitizing response headers such as Content-Security-Policy, X-Content-Type-Options: nosniff, or Content-Disposition: attachment. Because browsers treat text/html and image/svg+xml responses as active content in the document context, any JavaScript embedded in the uploaded file executes under the application's origin, enabling full same-origin access to cookies, localStorage, and DOM. The absence of security headers is the proximate control failure; no server-side content inspection or allowlist filtering is applied before delivery.
RemediationAI
Upgrade efw4.X to version 4.08.010 or later, which is the vendor-confirmed fix per the GitHub Security Advisory GHSA-hw67-p3gw-rrmj (https://github.com/efwGrp/efw4.X/security/advisories/GHSA-hw67-p3gw-rrmj). If immediate patching is not possible, the most targeted compensating control is to restrict file upload permissions so that only trusted roles can upload .html, .htm, and .svg files - this directly removes the attacker's ability to plant the payload. A second option is to configure the web server or a reverse proxy (e.g., nginx, Apache) to override MIME types for previewServlet responses with Content-Disposition: attachment, forcing downloads rather than inline rendering; this breaks XSS execution but may affect legitimate preview functionality for users. Adding X-Content-Type-Options: nosniff at the proxy layer reduces browser MIME sniffing risk but does not neutralize explicitly typed text/html responses. None of these workarounds are a substitute for patching, as they require accurate proxy configuration and may be bypassed if the servlet is directly accessible.
Arbitrary file write leading to unauthenticated remote code execution affects efw4.X (Enterprise Framework for Web) prio
Arbitrary file relocation in efwGrp's efw4.X Enterprise Framework for Web before 4.08.010 lets remote attackers copy or
Authorization bypass in efw4.X (Enterprise Framework for Web) before 4.08.010 lets an authenticated user defeat the elFi
Same weakness CWE-80 – Basic XSS
View allShare
External POC / Exploit Code
Leaving vuln.today