Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
efw4.X is an Enterprise Framework for Web. Prior to 4.08.010, the elfinder_checkRisk function validates target and targets for path traversal and home containment, but does not validate the dst (destination) parameter used by elfinder_paste. An attacker can copy or move files from within the home directory to any arbitrary destination by setting dst to a base64-encoded traversal path. This bypasses the protected=true security control. This vulnerability is fixed in 4.08.010.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
CVE-2026-44258 Path Traversal in efw4.X Prior to 4.08.010 via Unvalidated dst Parameter https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-44258
Post summary
The post discloses a path traversal flaw in efw4.X versions prior to 4.08.010 caused by an unvalidated dst parameter. It provides technical details but no PoC, exploit, or patch information.
CVE-2026-44258 efw4.X is an Enterprise Framework for Web. Prior to 4.08.010, the elfinder_checkRisk function validates target and targets for path traversal and home containment, bu… https://www.cve.org/CVERecord?id=CVE-2026-44258
Post summary
The CVE-2026-44258 is a path traversal vulnerability in the elfinder_checkRisk function, as noted in the CVE record.