Is CVE-2026-44259 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-44259 being exploited in the wild.

How severe is CVE-2026-44259?

Medium severity, with a CVSS score of 4.6, published 12 May 2026.

Is there a fix for CVE-2026-44259?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-44259 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-44259?

Check whether you run Eurotherm efw4.X at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44259: efwGrp efw4.X stored XSS in previewServlet

CVE-2026-44259 · Severity: medium · CVSS 4.6 · Published 2026-05-12

efw4.X is a web development framework used to build enterprise applications. A security flaw in its file preview component allows an attacker to upload malicious files that, when viewed by another user, execute unauthorized code in that user's browser. This could allow an attacker to perform actions on behalf of legitimate users, potentially leading to unauthorized data access or account takeover.

Technologies: Eurotherm efw4.X. Vendors: Eurotherm.

Quick answers

Is CVE-2026-44259 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-44259 being exploited in the wild.
How severe is CVE-2026-44259?: Medium severity, with a CVSS score of 4.6, published 12 May 2026.
Which products and versions are affected?: Eurotherm efw4.X < 4.08.010.
Is there a fix for CVE-2026-44259?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-44259 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-44259?: Check whether you run Eurotherm efw4.X at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stored Cross-Site Scripting (XSS) vulnerability exists in the previewServlet component of efw4.X. The servlet determines the MIME type of a file based solely on its extension (e.g., .html, .svg) and serves the content directly to the browser without sanitization or protective security headers like Content-Security-Policy or X-Content-Type-Options. An attacker with low-level privileges can upload a malicious file to the elfinder storage; when a victim previews this file, the embedded JavaScript executes within the application's origin. This allows the attacker to bypass same-origin protections and perform authenticated requests (CSRF) or session hijacking. The issue is resolved in version 4.08.010.

Affected products

efwGrp efw4.X < 4.08.010

Timeline

2026-04-28: advisory: GitHub Security Advisory published
2026-05-12: disclosed: CVE published to NVD

References

https://github.com/efwGrp/efw4.X/security/advisories/GHSA-hw67-p3gw-rrmj

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.