CVE-2026-44259

{
  "id": "CVE-2026-44259",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-12T22:16:36.277",
  "lastModified": "2026-10-26T14:10:00.130",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "efw4.X is an Enterprise Framework for Web. Prior to 4.08.010, the previewServlet serves files with their detected MIME type based on file extension, without any content sanitization or security headers. Files with .html, .htm, or .svg extensions are served as text/html or image/svg+xml respectively, causing any embedded JavaScript to execute in the victim's browser within the application's origin. This vulnerability is fixed in 4.08.010."
    },
    {
      "lang": "es",
      "value": "efw4.X es un Framework Empresarial para Web. Anteriormente a la 4.08.010, el previewServlet sirve archivos con su tipo MIME detectado basado en la extensión del archivo, sin ninguna sanitización de contenido ni encabezados de seguridad. Los archivos con extensiones .html, .htm o .svg se sirven como text/html o image/svg+xml respectivamente, causando que cualquier JavaScript incrustado se ejecute en el navegador de la víctima dentro del origen de la aplicación. Esta vulnerabilidad se ha corregido en la 4.08.010."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "efwGrp",
          "product": "efw4.X",
          "versions": [
            {
              "version": "< 4.08.010",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N",
          "baseScore": 4.6,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.1,
        "impactScore": 2.5
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-13T14:25:27.063639Z",
          "id": "CVE-2026-44259",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-80"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/efwGrp/efw4.X/security/advisories/GHSA-hw67-p3gw-rrmj",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/efwGrp/efw4.X/security/advisories/GHSA-hw67-p3gw-rrmj",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}