efw4.X CVE-2026-44259

The attacker must hold a valid, low-privilege authenticated session in efw4.X (PR:L) - unauthenticated exploitation is not possible per the CVSS vector. The attacker must additionally have permission to upload files with .html, .htm, or .svg extensions through the application; if upload functionality is restricted to higher roles or if these extensions are blocked by an upload allowlist, exploitation is prevented at that step. A victim with a separate authenticated session must be socially engineered or otherwise induced to open the previewServlet URL for the malicious file (UI:R) - the vulnerability does not self-propagate. Exploitation is not automatable (SSVC). What limits real-world impact: authentication barrier (PR:L), mandatory victim click (UI:R), scope confined to application origin (S:U), and low EPSS (0.03%) consistent with non-automated, targeted use only.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) scores 4.6 (Medium), correctly encoding two important friction points: the attacker requires a low-privilege authenticated session (PR:L) and the victim must actively preview the malicious file (UI:R). Scope is unchanged (S:U), meaning the blast radius is confined to the application's origin - no cross-system pivot is modeled. EPSS at 0.03% (8th percentile) is low and consistent with these barriers; opportunistic, unauthenticated mass exploitation is not viable. The SSVC assessment (POC confirmed, not automatable, partial technical impact) corroborates this: the attack chain requires human-in-the-loop steps that preclude automation. This vulnerability is NOT a high-urgency emergency in most environments - its real priority is proportional to the privilege level of typical users (if all users can upload files, the attack surface is broader) and the sensitivity of data accessible within the application's origin. It is not in CISA KEV. The low EPSS and non-automatable SSVC rating together suggest this is not being exploited opportunistically at scale.

An attacker with a low-privilege account crafts an .svg or .html file embedding a JavaScript payload that exfiltrates the victim's session cookie to an attacker-controlled endpoint, then uploads it to the efw4.X application. The attacker sends a previewServlet URL referencing the uploaded file to a higher-privileged user (e.g., an administrator), who opens the link and triggers same-origin script execution - silently harvesting the admin's session. A POC exists per SSVC data, lowering the bar for replication by less-skilled attackers.