PT-2026-40446 · Efw · Efw

Published 2026-05-12 · Updated 2026-05-13 · CVE-2026-44260

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions efw4.X versions prior to 4.08.010

Description The readonly flag in the 'efw:elFinder' JSP tag is intended to prevent file modifications. When protected=true, the elfinder checkRisk() function ensures the client sends readonly=true to match the session value. However, no event handler verifies the readonly value before executing write operations. Consequently, the flag only affects client-side UI elements and response metadata. An attacker can bypass the UI and send requests directly to perform file operations regardless of the readonly setting.

Recommendations Update to version 4.08.010.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-44260

Affected Products

Efw

References · 5

• 🔥 https://github.com/efwGrp/efw4.X/security/advisories/GHSA-5454-qhrf-vcvh · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-44260 · Security Note
• https://twitter.com/CVEnew/status/2054323989624057879 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2054442936696185340 · Twitter Post
• https://t.me/CVEtracker/53556 · Telegram Post