Is CVE-2026-44260 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-44260 being exploited in the wild.

How severe is CVE-2026-44260?

High severity, with a CVSS score of 8.1, published 12 May 2026.

Is there a fix for CVE-2026-44260?

A patch was published on 2026-05-12: Fix released in version 4.08.010 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-44260 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-44260?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44260: efwGrp efw4.X incorrect authorization in elFinder component

CVE-2026-44260 · Severity: high · CVSS 8.1 · Published 2026-05-12

efw4.X is an enterprise web development framework that includes a file management component. A security flaw allows users to bypass "read-only" restrictions, enabling them to create, modify, or delete files even when the system is configured to prevent such actions. This could lead to unauthorized data modification or the placement of malicious files on the server.

Quick answers

Is CVE-2026-44260 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-44260 being exploited in the wild.
How severe is CVE-2026-44260?: High severity, with a CVSS score of 8.1, published 12 May 2026.
Which products and versions are affected?: efwGrp efw4.X < 4.08.010.
Is there a fix for CVE-2026-44260?: A patch was published on 2026-05-12: Fix released in version 4.08.010 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44260 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-44260?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An authorization bypass exists in the <efw:elFinder> JSP tag of efw4.X due to improper server-side validation of the 'readonly' flag. While the framework verifies that the client-provided 'readonly' parameter matches the session state, the actual event handlers (such as elfinder_put, elfinder_mkfile, and elfinder_rm) do not check this flag before executing file system operations. The flag only influences client-side UI elements and response metadata. An attacker with low privileges can bypass the UI and send direct HTTP requests to perform arbitrary file operations, including writing, renaming, and deleting files. This vulnerability is addressed in version 4.08.010.

Affected products

efwGrp efw4.X < 4.08.010

Timeline

2026-04-28: advisory: GitHub advisory published by vendor
2026-05-12: disclosed: CVE published to NVD
2026-05-12: patched: Fix released in version 4.08.010

References

https://github.com/efwGrp/efw4.X/security/advisories/GHSA-5454-qhrf-vcvh

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.