# CVE-2026-44258: efwGrp efw4.X path traversal in elfinder_paste

Source: https://junglewise.ai/threats/cve-2026-44258-efwgrp-efw4-x-path-traversal-in-elfinder-paste  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-12. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

CVE-2026-44258 · Severity: info · CVSS 9.3 · Published 2026-05-12

efw4.X is an enterprise web development framework. A security flaw in its file management component allows an attacker to move or copy files to unauthorized locations on the server. This can be used to plant malicious scripts (webshells) in web directories, leading to a complete takeover of the server and access to sensitive data.

## Quick answers

**Is CVE-2026-44258 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44258 being exploited in the wild.

**How severe is CVE-2026-44258?** Informational severity, with a CVSS score of 9.3, published 12 May 2026.

**Which products and versions are affected?** efwGrp efw4.X < 4.08.010.

**Is there a fix for CVE-2026-44258?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-44258 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-44258?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A path traversal vulnerability exists in the elfinder_paste functionality of efw4.X. While the elfinder_checkRisk function validates the 'target' and 'targets' parameters for path traversal and home directory containment, it fails to inspect the 'dst' (destination) parameter. An attacker can provide a base64-encoded traversal path (e.g., '../../..') in the 'dst' parameter to copy or move files from the restricted home directory to arbitrary locations on the filesystem. By staging a JSP webshell in the home directory and using this flaw to copy it to the web application root, an unauthenticated attacker can achieve Remote Code Execution (RCE). This vulnerability is fixed in version 4.08.010.

## Affected products

- efwGrp efw4.X < 4.08.010

## Timeline

- 2026-04-28: advisory: GitHub Security Advisory published
- 2026-05-12: disclosed: CVE published to NVD

## References

- [https://github.com/efwGrp/efw4.X/security/advisories/GHSA-9g5w-qw96-jr3x](https://github.com/efwGrp/efw4.X/security/advisories/GHSA-9g5w-qw96-jr3x)