Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
efw4.X is an Enterprise Framework for Web. Prior to 4.08.010, efw.file.FileManager.unZip writes zip entries to disk using new File(baseDir, zipEntry.getName()) with no canonical-path check. An entry name such as ../../../pwned.jsp escapes the intended extraction directory and lands anywhere the Tomcat process can write — including the servlet context root. Combined with the framework's multipart /uploadServlet and an event that calls file.saveUploadFiles + FileManager.unZip, a remote attacker with no credentials drops a JSP webshell and executes arbitrary commands as the Tomcat user. This vulnerability is fixed in 4.08.010.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
CVE-2026-44257 Remote Code Execution via Path Traversal in efw4.X Before 4.08.010 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-44257
Post summary
A brief note announcing CVE-2026-44257, indicating an RCE vulnerability via path traversal in efw4.x before version 4.08.010, with a link to further details.
CVE-2026-44257 efw4.X is an Enterprise Framework for Web. Prior to 4.08.010, efw.file.FileManager.unZip writes zip entries to disk using new File(baseDir, zipEntry.getName()) with n… https://www.cve.org/CVERecord?id=CVE-2026-44257
Post summary
The post provides a brief disclosure of CVE-2026-44257, noting that the efw.file.FileManager.unZip component writes files to disk without sanitizing entry names.