CVE-2026-44258: efw4.X: Path Traversal via Unchecked dst Parameter

Overview

The efw4.X Enterprise Framework for Web has a path traversal weakness in its file copy and move handling. The target and targets parameters are checked for traversal and home directory containment, but the dst parameter used by elfinder_paste is not, according to the record. The record states this bypasses the protected=true control. The record title also mentions remote code execution, but the description does not explain how that outcome follows.

Impact

• The CNA-provided CVSS 4.0 vector describes a network attack with no privileges and no user interaction, with high impact on confidentiality, integrity and availability of the vulnerable system.
• Per the description, files can be copied or moved from the home directory to arbitrary locations, which threatens the integrity of other files on the host.
• The record's CWE is CWE-78 (OS Command Injection), which does not match the path traversal description. The relationship between the two is not explained in the record.

Affected products and versions

• Product: efwGrp efw4.X, versions prior to 4.08.010.
• The record does not list affected versions at or after 4.08.010.
• The fixes list in the record is empty, but the description states the issue is fixed in 4.08.010.

Exploitation status

The record shows this CVE is not listed in the CISA KEV catalog. No confirmed exploitation in the wild appears in the sources consulted. The SSVC data in the record lists exploitation as poc, which, by the SSVC scale, indicates that proof-of-concept material is recorded as existing; it does not confirm active exploitation. The EPSS probability is 0.00471 with a percentile of 0.39.

Remediation and mitigation

• Upgrade efw4.X to version 4.08.010 or later, as stated in the record.
• Until the upgrade is applied, restrict network access to the application and limit who can use its file management interface.
• Run the web service account with the least filesystem permissions needed, so that file operations cannot reach sensitive locations.
• Review the vendor's GitHub security advisory for details and confirm the fix in your deployment.

Detection guidance

• Review application logs for copy, move or paste operations whose destination falls outside the expected home directory.
• Look for files created or modified outside the expected directories of the application, especially by the web service account.
• Correlate file operation events with the user accounts and source addresses that performed them.

Limitations of the available information

• The record does not describe the mechanism by which the traversal leads to remote code execution, so that claim cannot be verified from the record alone.
• The CWE assignment (CWE-78) differs from the path traversal description, and the record does not reconcile them.
• The fixes list is empty, so the fixed version is known only from the description and the cited advisory.
• The source status is recorded as Deferred, and the record does not explain what that status means.
• The EPSS date in the record (2026-10-13) is later than the publication date (2026-05-12), so the EPSS values should be verified against a current source.

Frequently asked questions

What is the flaw in efw4.X?

According to the record, the dst parameter used by elfinder_paste is not validated for path traversal or home directory containment, although target and targets are checked. This allows file operations to reach arbitrary destinations.

Which versions are affected?

The record lists efwGrp efw4.X versions prior to 4.08.010 as affected, and states the issue is fixed in 4.08.010.

Is this vulnerability being actively exploited?

The record does not list this CVE in the CISA KEV catalog, and no confirmed exploitation in the wild appears in the sources consulted. The SSVC data lists exploitation as poc, which does not confirm active exploitation.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.