CVE Intelligence
Analysis AI-assisted

CVE-2026-44257: efw4.X Enterprise Framework: Zip Slip RCE in FileManager.unZip

CVE-2026-44257 affects efw4.X versions before 4.08.010, where the zip extraction routine does not verify that extracted paths stay inside the target directory. According to the record, an unauthenticated remote attacker could write files outside the intended folder and potentially run commands as the Tomcat service user. The CVSS 4.0 base score recorded is 9.3, and the vulnerability is not listed in CISA KEV.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

efw4.X is an Enterprise Framework for Web. According to the GitHub advisory referenced in the record, its zip extraction method (efw.file.FileManager.unZip) builds output paths from archive entry names without a canonical-path check, so entries can be written outside the intended directory. The record classifies the issue as CWE-77 (Command Injection), while the mechanism described is a path traversal (zip slip) problem. This difference is discussed under limitations.

Impact

  • The CVSS 4.0 vector in the record rates confidentiality, integrity and availability impact as High for the vulnerable system.
  • The record states that a remote attacker without credentials could, through a multipart upload path combined with extraction, place a server-side script in a web-reachable location and run commands as the Tomcat service account.
  • According to the description, any location the Tomcat process can write to may be reached.

Affected products and versions

  • Product: efwGrp efw4.X
  • Affected range in the record: versions before 4.08.010 (version < 4.08.010). The lower bound of the range is not stated.
  • Fixed version: 4.08.010, as stated in the description. The record's fixes field is empty, so this version comes only from the description text.

Exploitation status

  • CISA KEV: the record shows the vulnerability is not listed in KEV.
  • No confirmed exploitation in the wild appears in the sources consulted.
  • The SSVC exploitation field in the record is set to poc, which indicates a proof-of-concept status in that assessment. It does not confirm attacks.
  • The EPSS probability recorded is 0.0054 with a percentile of 0.43921, dated 2026-10-13 in the record.

Remediation and mitigation

  • Upgrade efw4.X to version 4.08.010 or later as the primary action.
  • If an upgrade cannot happen immediately, restrict access to file upload functionality and to any event that triggers archive extraction to trusted users and networks.
  • Run the Tomcat service with least privilege and make application directories, especially the web application root, non-writable for the service account where operationally feasible.
  • Confirm the deployed version against the GitHub advisory, since the record's fixes list is empty.
  • Review existing deployments for unexpected files in web-reachable directories.

Detection guidance

  • Review application and Tomcat logs for multipart upload requests followed by archive extraction activity.
  • Monitor file creation within web application directories, particularly new server-side script files appearing outside planned deployment windows.
  • Compare the contents of web roots against a known-good deployment baseline.
  • Maintain an inventory of efw4.X instances and their versions to identify exposure quickly.

Limitations of the available information

  • The record's source_status is Deferred, so the NVD and CVE entries may be incomplete or change.
  • The fixes field is empty; the fixed version relies on the description text.
  • The lower bound of the affected version range is unknown.
  • The CWE assigned in the record (CWE-77) differs from the path traversal mechanism described; the classification is not reconciled here.
  • No independent technical verification was performed for this analysis.
  • The EPSS and SSVC values are reported as recorded and are not independently validated.

Frequently asked questions

Which versions of efw4.X are affected by CVE-2026-44257?

The record lists versions before 4.08.010 as affected. The lower bound of the affected range is not stated.

Is CVE-2026-44257 listed in CISA KEV?

No. The record shows it is not listed in KEV, and no confirmed exploitation in the wild appears in the sources consulted.

What is the recommended action?

Upgrade efw4.X to 4.08.010 or later. If that is not immediately possible, restrict access to upload and extraction functionality and run Tomcat with least privilege.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.