efwGrp vulnerabilities
We track 3 vulnerabilities in efwGrp products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on May 12, 2026.
Latest efwGrp vulnerabilities
- 8.1 High severity
efw4.X: Incorrect Authorization
efw4.X is an Enterprise Framework for Web. Prior to 4.08.010, the readonly flag set on the <efw:elFinder> JSP tag is intended to prevent file modifications. When protected=true, elfinder_checkRisk enforces that the client sends readonly=true (matching the sess
- 9.3 Critical severity
efw4.X: Improper Neutralization of Special Elements used in an OS Command
efw4.X is an Enterprise Framework for Web. Prior to 4.08.010, the elfinder_checkRisk function validates target and targets for path traversal and home containment, but does not validate the dst (destination) parameter used by elfinder_paste. An attacker can co
- 9.3 Critical severity
efw4.X: Improper Neutralization of Special Elements used in a Command
efw4.X is an Enterprise Framework for Web. Prior to 4.08.010, efw.file.FileManager.unZip writes zip entries to disk using new File(baseDir, zipEntry.getName()) with no canonical-path check. An entry name such as ../../../pwned.jsp escapes the intended extracti