Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
efw4.X is an Enterprise Framework for Web. Prior to 4.08.010, the readonly flag set on the <efw:elFinder> JSP tag is intended to prevent file modifications. When protected=true, elfinder_checkRisk enforces that the client sends readonly=true (matching the session value), but no event handler checks the readonly value before performing write operations. The flag only controls client-side UI elements (disabling buttons) and response metadata (write: 0, locked: 1). An attacker who sends requests directly (bypassing the UI) can perform all file operations despite readonly=true. This vulnerability is fixed in 4.08.010.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
CVE-2026-44260 efw4.X is an Enterprise Framework for Web. Prior to 4.08.010, the readonly flag set on the <efw:elFinder> JSP tag is intended to prevent file modifications. When prot… https://www.cve.org/CVERecord?id=CVE-2026-44260
Post summary
The post discloses that versions of efw4.X prior to 4.08.010 have a flaw in the readonly flag of the JSP tag which could allow file modifications.
CVE-2026-44260 Unauthorized File Modification in efw4.X Prior to 4.08.010 via Re... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-44260 Customizable Vulnerability Alerts: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=4
Post summary
The post announces CVE‑2026‑44260, noting an unauthorized file modification flaw, and provides a link for more details, but does not disclose PoC, exploit, or patch information.