by Kastro
Paper/Archive/CVE-2026-44257

CVE-2026-44257

efwGrp efw4.X — efw4.X: RCE via zipslip

EPSS 0.4%public exploitCVSS 9.3
critical.is priorityof 100
45
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 33.2.332 × 206.6Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

efw4.X is an Enterprise Framework for Web. Prior to 4.08.010, efw.file.FileManager.unZip writes zip entries to disk using new File(baseDir, zipEntry.getName()) with no canonical-path check. An entry name such as ../../../pwned.jsp escapes the intended extraction directory and lands anywhere the Tomcat process can write — including the servlet context root. Combined with the framework's multipart /uploadServlet and an event that calls file.saveUploadFiles + FileManager.unZip, a remote attacker with no credentials drops a JSP webshell and executes arbitrary commands as the Tomcat user. This vulnerability is fixed in 4.08.010.

Affected

ProductAffectedFixed inSource
efw4.X< 4.08.010–CNA

Scores by source

GitHub_M (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitgithub.com/efwGrp/efw4.X/security/advisories/GHSA-q7jx-7x5r-r9f6