Executive brief
efw4.X is an enterprise web development framework. A security flaw in its file management component allows an attacker to upload and extract a malicious file that can bypass directory restrictions. This can lead to the installation of a 'webshell,' giving the attacker the ability to remotely execute commands and take full control of the web server.
Technical details
A Zip Slip vulnerability exists in efw.file.FileManager.unZip due to the lack of a canonical path check when processing zip entries. By crafting a ZIP file with entry names containing path traversal sequences (e.g., ../../../), an attacker can write files outside of the intended extraction directory. When combined with the framework's /uploadServlet and file.saveUploadFiles functionality, an unauthenticated remote attacker can drop a JSP webshell into the servlet context root. This results in remote code execution (RCE) with the privileges of the Tomcat process. The issue is resolved in version 4.08.010.
Affected products
- efwGrp efw4.X < 4.08.010
Timeline
- 2026-04-28: advisory: GitHub Security Advisory published
- 2026-05-12: disclosed: CVE published to NVD