CVE-2026-44259

Published: May 12, 2026Modified: Jun 17, 2026Deferred

4.6

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Exploitability: 2.1 / Impact: 2.5

Source: security-advisories@github.com (Secondary)

Description

efw4.X is an Enterprise Framework for Web. Prior to 4.08.010, the previewServlet serves files with their detected MIME type based on file extension, without any content sanitization or security headers. Files with .html, .htm, or .svg extensions are served as text/html or image/svg+xml respectively, causing any embedded JavaScript to execute in the victim's browser within the application's origin. This vulnerability is fixed in 4.08.010.

Related CWEs

CWE-80

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.

References (2)

https://github.com/efwGrp/efw4.X/security/advisories/GHSA-hw67-p3gw-rrmj

Source: security-advisories@github.com

https://github.com/efwGrp/efw4.X/security/advisories/GHSA-hw67-p3gw-rrmj

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.