# CVE-2026-44259: efwGrp efw4.X stored XSS in previewServlet

Source: https://junglewise.ai/threats/cve-2026-44259-efwgrp-efw4-x-stored-xss-in-previewservlet  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-12. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

CVE-2026-44259 · Severity: medium · CVSS 4.6 · Published 2026-05-12

efw4.X is a web development framework used to build enterprise applications. A security flaw in its file preview component allows an attacker to upload malicious files that, when viewed by another user, execute unauthorized code in that user's browser. This could allow an attacker to perform actions on behalf of legitimate users, potentially leading to unauthorized data access or account takeover.

Technologies: [Eurotherm efw4.X](https://junglewise.ai/threats/technologies/efw4-x). Vendors: [Eurotherm](https://junglewise.ai/threats/vendors/eurotherm).

## Quick answers

**Is CVE-2026-44259 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44259 being exploited in the wild.

**How severe is CVE-2026-44259?** Medium severity, with a CVSS score of 4.6, published 12 May 2026.

**Which products and versions are affected?** Eurotherm efw4.X < 4.08.010.

**Is there a fix for CVE-2026-44259?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-44259 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-44259?** Check whether you run Eurotherm efw4.X at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stored Cross-Site Scripting (XSS) vulnerability exists in the previewServlet component of efw4.X. The servlet determines the MIME type of a file based solely on its extension (e.g., .html, .svg) and serves the content directly to the browser without sanitization or protective security headers like Content-Security-Policy or X-Content-Type-Options. An attacker with low-level privileges can upload a malicious file to the elfinder storage; when a victim previews this file, the embedded JavaScript executes within the application's origin. This allows the attacker to bypass same-origin protections and perform authenticated requests (CSRF) or session hijacking. The issue is resolved in version 4.08.010.

## Affected products

- efwGrp efw4.X < 4.08.010

## Timeline

- 2026-04-28: advisory: GitHub Security Advisory published
- 2026-05-12: disclosed: CVE published to NVD

## References

- [https://github.com/efwGrp/efw4.X/security/advisories/GHSA-hw67-p3gw-rrmj](https://github.com/efwGrp/efw4.X/security/advisories/GHSA-hw67-p3gw-rrmj)

## Related threats

- [efwGrp efw4.X path traversal in FileManager.unZip](https://junglewise.ai/threats/cve-2026-44257-efwgrp-efw4-x-path-traversal-in-filemanager-unzip)