PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-44257 efwGrp CVE debrief

efw4.X Enterprise Framework for Web contains a critical path traversal vulnerability in its file extraction functionality. The `efw.file.FileManager.unZip` method prior to version 4.08.010 constructs file paths using `new File(baseDir, zipEntry.getName())` without canonical path validation. This allows malicious zip entries containing directory traversal sequences (e.g., `../../../pwned.jsp`) to escape the intended extraction directory. When combined with the framework's multipart upload servlet (`/uploadServlet`) and event handlers that invoke `file.saveUploadFiles` followed by `FileManager.unZip`, an unauthenticated remote attacker can write JSP files to arbitrary locations writable by the Tomcat process, including the servlet context root. This enables deployment of JSP webshells and arbitrary command execution as the Tomcat user. The vulnerability is resolved in version 4.08.010.

Vendor
efwGrp
Product
efw4.X
CVSS
CRITICAL 9.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-12
Original CVE updated
2026-05-18
Advisory published
2026-05-12
Advisory updated
2026-05-18

Who should care

Organizations running efw4.X Enterprise Framework for Web versions prior to 4.08.010; security teams monitoring Java web applications with archive upload functionality; incident responders investigating unauthorized JSP deployments on Tomcat servers

Technical summary

The vulnerability stems from insufficient path validation during zip extraction. The `FileManager.unZip` method directly uses zip entry names as relative paths without sanitization or canonicalization checks. Attackers craft malicious zip archives containing entries with `../` sequences that traverse upward from the intended extraction directory. When the framework's upload handling pipeline processes these archives, files are written to attacker-controlled locations. Placing JSP files in the web application root enables server-side code execution. The attack chain requires: (1) access to the multipart upload servlet, (2) an event handler that persists uploads and invokes unZip, and (3) write permissions to the target directory from the Tomcat process context.

Defensive priority

critical

Recommended defensive actions

  • Upgrade efw4.X to version 4.08.010 or later
  • If immediate patching is not feasible, disable or restrict access to the /uploadServlet endpoint
  • Implement network-level controls to limit access to administrative interfaces
  • Review application logs for suspicious zip upload patterns containing path traversal sequences
  • Scan deployed applications for unexpected JSP files in web-accessible directories
  • Validate that extracted archive contents remain within intended destination directories

Evidence notes

Vulnerability description confirms path traversal via zip entry name manipulation; CVSS 4.0 vector indicates network attack vector with no privileges required; GitHub Security Advisory GHSA-q7jx-7x5r-r9f6 provides vendor acknowledgment and fix version

Official resources

2026-05-12