CVE-2026-44259

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-44259", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-05T16:33:55.844Z", "datePublished": "2026-05-12T21:08:27.846Z", "dateUpdated": "2026-05-13T14:25:44.992Z"}, "containers": {"cna": {"title": "efw4.X: Stored XSS via previewServlet", "problemTypes": [{"descriptions": [{"cweId": "CWE-80", "lang": "en", "description": "CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/efwGrp/efw4.X/security/advisories/GHSA-hw67-p3gw-rrmj", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/efwGrp/efw4.X/security/advisories/GHSA-hw67-p3gw-rrmj"}], "affected": [{"vendor": "efwGrp", "product": "efw4.X", "versions": [{"version": "< 4.08.010", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-12T21:08:27.846Z"}, "descriptions": [{"lang": "en", "value": "efw4.X is an Enterprise Framework for Web. Prior to 4.08.010, the previewServlet serves files with their detected MIME type based on file extension, without any content sanitization or security headers. Files with .html, .htm, or .svg extensions are served as text/html or image/svg+xml respectively, causing any embedded JavaScript to execute in the victim's browser within the application's origin. This vulnerability is fixed in 4.08.010."}], "source": {"advisory": "GHSA-hw67-p3gw-rrmj", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/efwGrp/efw4.X/security/advisories/GHSA-hw67-p3gw-rrmj", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-13T14:25:27.063639Z", "id": "CVE-2026-44259", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-13T14:25:44.992Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-44259", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-13T14:25:27.063639Z"}}}], "references": [{"url": "https://github.com/efwGrp/efw4.X/security/advisories/GHSA-hw67-p3gw-rrmj", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-13T14:25:41.227Z"}}], "cna": {"title": "efw4.X: Stored XSS via previewServlet", "source": {"advisory": "GHSA-hw67-p3gw-rrmj", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.6, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "efwGrp", "product": "efw4.X", "versions": [{"status": "affected", "version": "< 4.08.010"}]}], "references": [{"url": "https://github.com/efwGrp/efw4.X/security/advisories/GHSA-hw67-p3gw-rrmj", "name": "https://github.com/efwGrp/efw4.X/security/advisories/GHSA-hw67-p3gw-rrmj", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "efw4.X is an Enterprise Framework for Web. Prior to 4.08.010, the previewServlet serves files with their detected MIME type based on file extension, without any content sanitization or security headers. Files with .html, .htm, or .svg extensions are served as text/html or image/svg+xml respectively, causing any embedded JavaScript to execute in the victim's browser within the application's origin. This vulnerability is fixed in 4.08.010."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-80", "description": "CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-12T21:08:27.846Z"}}}, "cveMetadata": {"cveId": "CVE-2026-44259", "state": "PUBLISHED", "dateUpdated": "2026-05-13T14:25:44.992Z", "dateReserved": "2026-05-05T16:33:55.844Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-12T21:08:27.846Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "efw4.X", "vendor": "efwGrp", "versions": [{"status": "affected", "version": "< 4.08.010"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "efw4.X is an Enterprise Framework for Web. Prior to 4.08.010, the previewServlet serves files with their detected MIME type based on file extension, without any content sanitization or security headers. Files with .html, .htm, or .svg extensions are served as text/html or image/svg+xml respectively, causing any embedded JavaScript to execute in the victim's browser within the application's origin. This vulnerability is fixed in 4.08.010."}, {"lang": "es", "value": "efw4.X es un Framework Empresarial para Web. Anteriormente a la 4.08.010, el previewServlet sirve archivos con su tipo MIME detectado basado en la extensi\u00f3n del archivo, sin ninguna sanitizaci\u00f3n de contenido ni encabezados de seguridad. Los archivos con extensiones .html, .htm o .svg se sirven como text/html o image/svg+xml respectivamente, causando que cualquier JavaScript incrustado se ejecute en el navegador de la v\u00edctima dentro del origen de la aplicaci\u00f3n. Esta vulnerabilidad se ha corregido en la 4.08.010."}], "id": "CVE-2026-44259", "lastModified": "2026-10-26T14:10:00.130", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 2.5, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44259", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-13T14:25:27.063639Z", "version": "2.0.3"}}]}, "published": "2026-05-12T22:16:36.277", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/efwGrp/efw4.X/security/advisories/GHSA-hw67-p3gw-rrmj"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/efwGrp/efw4.X/security/advisories/GHSA-hw67-p3gw-rrmj"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-80"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,4.08.010)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "efw4.X", "source": "cna", "vendor": "efwGrp"}, "product": "efw4.x", "vendor": "efwgrp"}], "created": "2026-05-12T23:00:12.430328+00:00", "updated": "2026-05-13T10:35:31.194932+00:00", "vendors": ["efwgrp", "efwgrp$PRODUCT$efw4.x"]}