CVE-2026-44260

efw4.X is an Enterprise Framework for Web. Prior to 4.08.010, the readonly flag set on the <efw:elFinder> JSP tag is intended to prevent file modifications. When protected=true, elfinder_checkRisk enforces that the client sends readonly=true (matching the session value), but no event handler checks the readonly value before performing write operations. The flag only controls client-side UI elements (disabling buttons) and response metadata (write: 0, locked: 1). An attacker who sends requests directly (bypassing the UI) can perform all file operations despite readonly=true. This vulnerability is fixed in 4.08.010.

• CWE-863

• https://github.com/efwGrp/efw4.X/security/advisories/GHSA-5454-qhrf-vcvh
• https://github.com/efwGrp/efw4.X/security/advisories/GHSA-5454-qhrf-vcvh

Published

May 12, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-44250Netty is a network application framework for development of …7.5
• CVE-2026-44251Wazuh is a free and open source platform used for threat pre…6.5
• CVE-2026-44257efw4.X is an Enterprise Framework for Web. Prior to 4.08.010…9.3
• CVE-2026-44258efw4.X is an Enterprise Framework for Web. Prior to 4.08.010…9.3
• CVE-2026-44259efw4.X is an Enterprise Framework for Web. Prior to 4.08.010…4.6
• CVE-2026-4426A flaw was found in libarchive. An Undefined Behavior vulner…6.5
• CVE-2026-44262Scramble generates API documentation for Laravel project. Fr…9.4
• CVE-2026-44263Weblate is a web based localization tool. Prior to version 5…4.3
• CVE-2026-44264Weblate is a web based localization tool. Prior to version 5…4.3
• CVE-2026-44268Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6,…4.4
• CVE-2026-44269Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6,…4.4
• CVE-2026-4427Rejected reason: Duplicate of CVE-2026-32286