What is the CVSS score of CVE-2026-44260?

CVE-2026-44260 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of efw4.X are affected by CVE-2026-44260?

Enterprise Framework for Web (efw4.X) before version 4.08.010 contains an authorization bypass allowing authenticated users to circumvent file access restrictions and perform unrestricted file…. A patch is available.

How to fix or mitigate CVE-2026-44260?

Within 24 hours, identify all systems running efw4.X and document current versions in your environment. Within 7 days, upgrade all affected instances to version 4.08.010 or later, prioritizing production systems. Within 30 days, review file modification logs and conduct integrity verification on systems that were running vulnerable versions to detect any unauthorized file operations during the exposure period.

efw4.X CVE-2026-44260

EUVD-2026-29845 HIGH

Incorrect Authorization (CWE-863)

2026-05-12 GitHub_M

Authentication Bypass Efw4 X

8.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Network-reachable authenticated user (PR:L) bypasses the read-only control with low complexity; full file read/write yields C:H/I:H, while availability is not the primary impact so A:N.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 19:17 vuln.today

Patch available

May 12, 2026 - 22:03 EUVD

CVE Published

May 12, 2026 - 21:09 nvd

HIGH 8.1

DescriptionGitHub Advisory

efw4.X is an Enterprise Framework for Web. Prior to 4.08.010, the readonly flag set on the <efw:elFinder> JSP tag is intended to prevent file modifications. When protected=true, elfinder_checkRisk enforces that the client sends readonly=true (matching the session value), but no event handler checks the readonly value before performing write operations. The flag only controls client-side UI elements (disabling buttons) and response metadata (write: 0, locked: 1). An attacker who sends requests directly (bypassing the UI) can perform all file operations despite readonly=true. This vulnerability is fixed in 4.08.010.

AnalysisAI

Authorization bypass in efw4.X (Enterprise Framework for Web) before 4.08.010 lets an authenticated user defeat the elFinder read-only protection and perform full file operations. Although the <efw:elFinder> JSP tag with protected=true validates that the client sends readonly=true, no server-side event handler checks that value before executing writes, so the flag only disables UI buttons and sets response metadata (write: 0, locked: 1). SSVC rates technical impact as total and a proof-of-concept exists, though EPSS is very low (0.03%) and there is no public weaponization identified at time of analysis.

Technical ContextAI

The affected component is the elFinder integration exposed through efw4.X's <efw:elFinder> JSP tag. elFinder is a web-based file manager whose backend connector handles commands such as mkdir, rm, rename, upload, and put over HTTP. In efw4.X the intended read-only enforcement (elfinder_checkRisk) validates a client-supplied readonly=true parameter against the session when protected=true, but this check is advisory: it gates a risk check, not the command handlers themselves. The write, mkfile, rm and similar handlers never consult the readonly state, so authorization is enforced only in the client UI (disabled buttons) and in response metadata. This maps to CWE-863 (Incorrect Authorization): a security decision is made but on the wrong side of the trust boundary, letting the client simply not honor it. The affected package is identified by CPE cpe:2.3:a:efwgrp:efw4.x, and EUVD lists all versions below 4.08.010.

RemediationAI

Vendor-released patch: upgrade efw4.X to 4.08.010 or later, which adds server-side enforcement of the read-only state in the command handlers, as described in the GitHub advisory https://github.com/efwGrp/efw4.X/security/advisories/GHSA-5454-qhrf-vcvh. If you cannot upgrade immediately, do not rely on the readonly/protected UI flag for security: restrict access to the elFinder connector endpoint to trusted authenticated operators only (for example via reverse-proxy path or IP allow-listing), which prevents low-trust users from reaching the writable commands at the cost of blocking legitimate remote file-manager use. Alternatively, enforce read-only access at the filesystem or OS permission layer for the directories elFinder exposes, so write and delete commands fail regardless of the application flag, with the trade-off that legitimate write features are disabled until patched. Removing or disabling the <efw:elFinder> tag on pages that are meant to be read-only fully eliminates the exposure where the feature is not required.