efw4.X: Stored XSS via previewServlet_CVE-2026-44259

4.6 / 10

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Description

efw4.X is an Enterprise Framework for Web. Prior to 4.08.010, the previewServlet serves files with their detected MIME type based on file extension, without any content sanitization or security headers. Files with .html, .htm, or .svg extensions are served as text/html or image/svg+xml respectively, causing any embedded JavaScript to execute in the victim's browser within the application's origin. This vulnerability is fixed in 4.08.010.

Basic Information

ID CVE-2026-44259

Source GitHub_M

Published May 12, 2026 at 21:08

Affected Product

Vendor efwGrp

Product efw4.X

Version < 4.08.010

Affected Versions efwGrp efw4.X < 4.08.010

CWE Classification

CWE-80

References

github.com /efwGrp/efw4.X/security/advisories/GHSA-hw67-p3gw-rrmj

{
    "lastseen": "",
    "description": "efw4.X is an Enterprise Framework for Web. Prior to 4.08.010, the previewServlet serves files with their detected MIME type based on file extension, without any content sanitization or security headers. Files with .html, .htm, or .svg extensions are served as text/html or image/svg+xml respectively, causing any embedded JavaScript to execute in the victim's browser within the application's origin. This vulnerability is fixed in 4.08.010.",
    "published": "2026-05-12T21:08:27.846Z",
    "modified": "2026-05-12T21:08:27.846Z",
    "type": "cve",
    "title": "efw4.X: Stored XSS via previewServlet",
    "source": "GitHub_M",
    "references": "https://github.com/efwGrp/efw4.X/security/advisories/GHSA-hw67-p3gw-rrmj",
    "id": "CVE-2026-44259",
    "bulletinFamily": "",
    "cwe": [
        "CWE-80"
    ],
    "cvelist": null,
    "sourceData": "efwGrp efw4.X < 4.08.010",
    "sourceHref": "",
    "cvss": {
        "score": 4.6,
        "severity": "MEDIUM",
        "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N",
        "version": "3.1"
    },
    "cvss2": [],
    "cvss3": {
        "version": "",
        "vectorString": "",
        "baseScore": 0,
        "baseSeverity": "",
        "attackVector": "",
        "attackComplexity": "",
        "privilegesRequired": "",
        "userInteraction": "",
        "scope": "",
        "confidentialityImpact": "",
        "integrityImpact": "",
        "availabilityImpact": "",
        "cvssV3": {
            "version": "",
            "vectorString": "",
            "baseScore": 0,
            "baseSeverity": "",
            "attackVector": "",
            "attackComplexity": "",
            "privilegesRequired": "",
            "userInteraction": "",
            "scope": "",
            "confidentialityImpact": "",
            "integrityImpact": "",
            "availabilityImpact": ""
        }
    },
    "href": "",
    "category_name": "CVE",
    "post_link": "",
    "product": "efw4.X",
    "version": "< 4.08.010",
    "vendor": "efwGrp",
    "ai_description": "",
    "ai_severity": "",
    "ai_vendor": "",
    "ai_product": "",
    "ai_version": "",
    "ai_score": 0
}