EUVD-2026-29845Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to efw4.X elFinder endpoint
-
DeliveryCraft direct connector write request
-
ExploitSupply readonly=true to pass checkRisk
-
ExecutionHandler skips readonly enforcement
-
ImpactCreate, modify, or delete protected files
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an efw4.X page using the <efw:elFinder> JSP tag configured with protected=true and readonly=true, plus an authenticated session valid for that elFinder endpoint (CVSS PR:L - the attacker must be a legitimate framework user, not anonymous). The attacker must bypass the browser UI and send requests directly to the elFinder connector; readonly=true must still be supplied to satisfy elfinder_checkRisk, but no handler enforces it before writing. Limiting factors: it affects only versions before 4.08.010, only where the read-only elFinder feature is actually deployed, and only for principals who can already authenticate - so realistic exposure is bounded by how broadly the elFinder endpoint is reachable and how low-trust the authenticated user population is. |
| Impact | The signals are moderate and internally consistent. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, base 8.1) indicates a network-reachable, low-complexity attack that requires some privileges (PR:L), consistent with the description, since the attacker must be an authenticated framework user with session access to the elFinder endpoint. SSVC corroborates high impact (Technical Impact: total) but flags Automatable: no and Exploitation: poc, meaning it is demonstrable but not a mass scan-and-own bug. EPSS is very low (0.03%, 8th percentile) and the CVE is not on CISA KEV, so there is no evidence of widespread or active exploitation. Real-world risk hinges on who can authenticate: if the elFinder feature is exposed to low-trust or self-registered users, the integrity impact is serious; if it is reachable only by trusted internal operators, exposure is contained. No signal conflict is present - CVSS PR:L aligns with the description's premise that the attacker sends authenticated requests directly. |
| Exploit ScenarioDerived | An authenticated user opens a page that renders elFinder in protected read-only mode, where the UI shows disabled buttons. Instead of using the UI, they send a crafted HTTP request directly to the elFinder connector with a write, rm, or upload command (supplying readonly=true so elfinder_checkRisk passes), and the server executes it because no handler verifies the read-only state. A proof-of-concept is reported to exist, and the low attack complexity (AC:L) means no special timing or tooling is needed beyond a valid session. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 23, 2026
Authorization bypass in efw4.X (Enterprise Framework for Web) before 4.08.010 lets an authenticated user defeat the elFinder read-only protection and perform full file operations. Although the <efw:elFinder> JSP tag with protected=true validates that the client sends readonly=true, no server-side event handler checks that value before executing writes, so the flag only disables UI buttons and sets response metadata (write: 0, locked: 1). SSVC rates technical impact as total and a proof-of-concept exists, though EPSS is very low (0.03%) and there is no public weaponization identified at time of analysis.
RemediationAI
Vendor-released patch: upgrade efw4.X to 4.08.010 or later, which adds server-side enforcement of the read-only state in the command handlers, as described in the GitHub advisory https://github.com/efwGrp/efw4.X/security/advisories/GHSA-5454-qhrf-vcvh. If you cannot upgrade immediately, do not rely on the readonly/protected UI flag for security: restrict access to the elFinder connector endpoint to trusted authenticated operators only (for example via reverse-proxy path or IP allow-listing), which prevents low-trust users from reaching the writable commands at the cost of blocking legitimate remote file-manager use. Alternatively, enforce read-only access at the filesystem or OS permission layer for the directories elFinder exposes, so write and delete commands fail regardless of the application flag, with the trade-off that legitimate write features are disabled until patched. Removing or disabling the <efw:elFinder> tag on pages that are meant to be read-only fully eliminates the exposure where the feature is not required.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the elFinder integration exposed through efw4.X's <efw:elFinder> JSP tag. elFinder is a web-based file manager whose backend connector handles commands such as mkdir, rm, rename, upload, and put over HTTP. In efw4.X the intended read-only enforcement (elfinder_checkRisk) validates a client-supplied readonly=true parameter against the session when protected=true, but this check is advisory: it gates a risk check, not the command handlers themselves. The write, mkfile, rm and similar handlers never consult the readonly state, so authorization is enforced only in the client UI (disabled buttons) and in response metadata. This maps to CWE-863 (Incorrect Authorization): a security decision is made but on the wrong side of the trust boundary, letting the client simply not honor it. The affected package is identified by CPE cpe:2.3:a:efwgrp:efw4.x, and EUVD lists all versions below 4.08.010.
Know when Efw4 X gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Network-reachable authenticated user (PR:L) bypasses the read-only control with low complexity; full file read/write yields C:H/I:H, while availability is not the primary impact so A:N.
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
efw4.X is an Enterprise Framework for Web. Prior to 4.08.010, the readonly flag set on the <efw:elFinder> JSP tag is intended to prevent file modifications. When protected=true, elfinder_checkRisk enforces that the client sends readonly=true (matching the session value), but no event handler checks the readonly value before performing write operations. The flag only controls client-side UI elements (disabling buttons) and response metadata (write: 0, locked: 1). An attacker who sends requests directly (bypassing the UI) can perform all file operations despite readonly=true. This vulnerability is fixed in 4.08.010.
Executive ViewAI
Enterprise Framework for Web (efw4.X) before version 4.08.010 contains an authorization bypass allowing authenticated users to circumvent file access restrictions and perform unrestricted file operations, creating risk of data modification and compliance violations. This affects organizations relying on efw4.X for access control enforcement, particularly sensitive data environments.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Arbitrary file write leading to unauthenticated remote code execution affects efw4.X (Enterprise Framework for Web) prio
Arbitrary file relocation in efwGrp's efw4.X Enterprise Framework for Web before 4.08.010 lets remote attackers copy or
Stored cross-site scripting in efw4.X's previewServlet allows authenticated low-privilege users to cause arbitrary JavaS
Exploit-DB