Executive brief
efw4.X is an enterprise web development framework that includes a file management component. A security flaw allows users to bypass "read-only" restrictions, enabling them to create, modify, or delete files even when the system is configured to prevent such actions. This could lead to unauthorized data modification or the placement of malicious files on the server.
Technical details
An authorization bypass exists in the <efw:elFinder> JSP tag of efw4.X due to improper server-side validation of the 'readonly' flag. While the framework verifies that the client-provided 'readonly' parameter matches the session state, the actual event handlers (such as elfinder_put, elfinder_mkfile, and elfinder_rm) do not check this flag before executing file system operations. The flag only influences client-side UI elements and response metadata. An attacker with low privileges can bypass the UI and send direct HTTP requests to perform arbitrary file operations, including writing, renaming, and deleting files. This vulnerability is addressed in version 4.08.010.
Affected products
- efwGrp efw4.X < 4.08.010
Timeline
- 2026-04-28: advisory: GitHub advisory published by vendor
- 2026-05-12: disclosed: CVE published to NVD
- 2026-05-12: patched: Fix released in version 4.08.010