Executive brief
efw4.X is a web development framework used to build enterprise applications. A security flaw in its file preview component allows an attacker to upload malicious files that, when viewed by another user, execute unauthorized code in that user's browser. This could allow an attacker to perform actions on behalf of legitimate users, potentially leading to unauthorized data access or account takeover.
Technical details
A stored Cross-Site Scripting (XSS) vulnerability exists in the previewServlet component of efw4.X. The servlet determines the MIME type of a file based solely on its extension (e.g., .html, .svg) and serves the content directly to the browser without sanitization or protective security headers like Content-Security-Policy or X-Content-Type-Options. An attacker with low-level privileges can upload a malicious file to the elfinder storage; when a victim previews this file, the embedded JavaScript executes within the application's origin. This allows the attacker to bypass same-origin protections and perform authenticated requests (CSRF) or session hijacking. The issue is resolved in version 4.08.010.
Affected products
- efwGrp efw4.X < 4.08.010
Timeline
- 2026-04-28: advisory: GitHub Security Advisory published
- 2026-05-12: disclosed: CVE published to NVD