Efw4 X
Monthly
Authorization bypass in efw4.X (Enterprise Framework for Web) before 4.08.010 lets an authenticated user defeat the elFinder read-only protection and perform full file operations. Although the <efw:elFinder> JSP tag with protected=true validates that the client sends readonly=true, no server-side event handler checks that value before executing writes, so the flag only disables UI buttons and sets response metadata (write: 0, locked: 1). SSVC rates technical impact as total and a proof-of-concept exists, though EPSS is very low (0.03%) and there is no public weaponization identified at time of analysis.
Stored cross-site scripting in efw4.X's previewServlet allows authenticated low-privilege users to cause arbitrary JavaScript execution in victims' browsers by uploading .html, .htm, or .svg files that are served without sanitization or protective security headers. All efw4.X versions prior to 4.08.010 are affected; the framework serves these files with text/html or image/svg+xml MIME types derived from extension alone, giving browsers a green light to parse and execute embedded scripts within the application's origin. No active exploitation confirmed in CISA KEV, but SSVC data confirms a POC exists; EPSS at 0.03% (8th percentile) reflects low opportunistic exploitation probability consistent with the authentication and user-interaction requirements.
Arbitrary file write leading to unauthenticated remote code execution affects efw4.X (Enterprise Framework for Web) prior to 4.08.010, where efw.file.FileManager.unZip extracts ZIP entries via new File(baseDir, zipEntry.getName()) with no canonical-path validation - a classic Zip Slip. By combining the framework's public multipart /uploadServlet with an event that chains file.saveUploadFiles and FileManager.unZip, an attacker with no credentials can plant a JSP webshell in the Tomcat servlet context root and execute OS commands as the Tomcat user. Publicly available exploit code exists (SSVC lists proof-of-concept); the flaw is not on CISA KEV and EPSS is low (0.21%, 43rd percentile).
Arbitrary file relocation in efwGrp's efw4.X Enterprise Framework for Web before 4.08.010 lets remote attackers copy or move files out of the home directory to any location on the host by supplying a base64-encoded traversal path in the elfinder_paste 'dst' parameter. The elfinder_checkRisk routine validates the 'target'/'targets' parameters for traversal and home containment but overlooks 'dst', bypassing the protected=true control. Publicly available exploit code exists (SSVC: PoC), though EPSS is only 0.05% and it is not in CISA KEV.
Authorization bypass in efw4.X (Enterprise Framework for Web) before 4.08.010 lets an authenticated user defeat the elFinder read-only protection and perform full file operations. Although the <efw:elFinder> JSP tag with protected=true validates that the client sends readonly=true, no server-side event handler checks that value before executing writes, so the flag only disables UI buttons and sets response metadata (write: 0, locked: 1). SSVC rates technical impact as total and a proof-of-concept exists, though EPSS is very low (0.03%) and there is no public weaponization identified at time of analysis.
Stored cross-site scripting in efw4.X's previewServlet allows authenticated low-privilege users to cause arbitrary JavaScript execution in victims' browsers by uploading .html, .htm, or .svg files that are served without sanitization or protective security headers. All efw4.X versions prior to 4.08.010 are affected; the framework serves these files with text/html or image/svg+xml MIME types derived from extension alone, giving browsers a green light to parse and execute embedded scripts within the application's origin. No active exploitation confirmed in CISA KEV, but SSVC data confirms a POC exists; EPSS at 0.03% (8th percentile) reflects low opportunistic exploitation probability consistent with the authentication and user-interaction requirements.
Arbitrary file write leading to unauthenticated remote code execution affects efw4.X (Enterprise Framework for Web) prior to 4.08.010, where efw.file.FileManager.unZip extracts ZIP entries via new File(baseDir, zipEntry.getName()) with no canonical-path validation - a classic Zip Slip. By combining the framework's public multipart /uploadServlet with an event that chains file.saveUploadFiles and FileManager.unZip, an attacker with no credentials can plant a JSP webshell in the Tomcat servlet context root and execute OS commands as the Tomcat user. Publicly available exploit code exists (SSVC lists proof-of-concept); the flaw is not on CISA KEV and EPSS is low (0.21%, 43rd percentile).
Arbitrary file relocation in efwGrp's efw4.X Enterprise Framework for Web before 4.08.010 lets remote attackers copy or move files out of the home directory to any location on the host by supplying a base64-encoded traversal path in the elfinder_paste 'dst' parameter. The elfinder_checkRisk routine validates the 'target'/'targets' parameters for traversal and home containment but overlooks 'dst', bypassing the protected=true control. Publicly available exploit code exists (SSVC: PoC), though EPSS is only 0.05% and it is not in CISA KEV.