# CVE-2026-44257: efwGrp efw4.X path traversal in FileManager.unZip

Source: https://junglewise.ai/threats/cve-2026-44257-efwgrp-efw4-x-path-traversal-in-filemanager-unzip  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-12. Updated: 2026-05-18  
License: CC BY 4.0 with a link back

CVE-2026-44257 · Severity: info · CVSS 9.3 · Published 2026-05-12

efw4.X is an enterprise web development framework. A security flaw in its file management component allows an attacker to upload and extract a malicious file that can bypass directory restrictions. This can lead to the installation of a 'webshell,' giving the attacker the ability to remotely execute commands and take full control of the web server.

Technologies: [Eurotherm efw4.X](https://junglewise.ai/threats/technologies/efw4-x). Vendors: [Eurotherm](https://junglewise.ai/threats/vendors/eurotherm).

## Quick answers

**Is CVE-2026-44257 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44257 being exploited in the wild.

**How severe is CVE-2026-44257?** Informational severity, with a CVSS score of 9.3, published 12 May 2026.

**Which products and versions are affected?** Eurotherm efw4.X < 4.08.010.

**Is there a fix for CVE-2026-44257?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-44257 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-44257?** Check whether you run Eurotherm efw4.X at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Zip Slip vulnerability exists in efw.file.FileManager.unZip due to the lack of a canonical path check when processing zip entries. By crafting a ZIP file with entry names containing path traversal sequences (e.g., ../../../), an attacker can write files outside of the intended extraction directory. When combined with the framework's /uploadServlet and file.saveUploadFiles functionality, an unauthenticated remote attacker can drop a JSP webshell into the servlet context root. This results in remote code execution (RCE) with the privileges of the Tomcat process. The issue is resolved in version 4.08.010.

## Affected products

- efwGrp efw4.X < 4.08.010

## Timeline

- 2026-04-28: advisory: GitHub Security Advisory published
- 2026-05-12: disclosed: CVE published to NVD

## References

- [https://github.com/efwGrp/efw4.X/security/advisories/GHSA-q7jx-7x5r-r9f6](https://github.com/efwGrp/efw4.X/security/advisories/GHSA-q7jx-7x5r-r9f6)

## Related threats

- [efwGrp efw4.X stored XSS in previewServlet](https://junglewise.ai/threats/cve-2026-44259-efwgrp-efw4-x-stored-xss-in-previewservlet)