CVE-2026-44260

{
  "id": "CVE-2026-44260",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-12T22:16:36.417",
  "lastModified": "2026-10-26T14:10:00.130",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "efw4.X is an Enterprise Framework for Web. Prior to 4.08.010, the readonly flag set on the <efw:elFinder> JSP tag is intended to prevent file modifications. When protected=true, elfinder_checkRisk enforces that the client sends readonly=true (matching the session value), but no event handler checks the readonly value before performing write operations. The flag only controls client-side UI elements (disabling buttons) and response metadata (write: 0, locked: 1). An attacker who sends requests directly (bypassing the UI) can perform all file operations despite readonly=true. This vulnerability is fixed in 4.08.010."
    },
    {
      "lang": "es",
      "value": "efw4.X es un Framework Empresarial para Web. Antes de la versión 4.08.010, la bandera readonly establecida en la etiqueta JSP <efw:elFinder> está destinada a prevenir modificaciones de archivos. Cuando protected=true, elfinder_checkRisk impone que el cliente envíe readonly=true (coincidiendo con el valor de la sesión), pero ningún gestor de eventos verifica el valor de readonly antes de realizar operaciones de escritura. La bandera solo controla elementos de la interfaz de usuario del lado del cliente (deshabilitando botones) y metadatos de respuesta (write: 0, locked: 1). Un atacante que envía solicitudes directamente (saltándose la interfaz de usuario) puede realizar todas las operaciones de archivo a pesar de readonly=true. Esta vulnerabilidad está corregida en la versión 4.08.010."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "efwGrp",
          "product": "efw4.X",
          "versions": [
            {
              "version": "< 4.08.010",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
          "baseScore": 8.1,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-13T15:03:54.867112Z",
          "id": "CVE-2026-44260",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/efwGrp/efw4.X/security/advisories/GHSA-5454-qhrf-vcvh",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/efwGrp/efw4.X/security/advisories/GHSA-5454-qhrf-vcvh",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}