CVE-2026-44259 Details

A stored cross-site scripting vulnerability has been identified in efw4.X versions prior to 4.08.010. The issue arises in the previewServlet, which serves files based on their detected MIME type from the file extension, without any content sanitization or security headers. This flaw allows embedded JavaScript in files with .html, .htm, or .svg extensions to execute in the context of the application's origin. An attacker who can upload files to the elfinder storage can exploit this by embedding malicious JavaScript in an HTML or SVG file. When the file is previewed, the script executes with full access to the application's origin, potentially leading to session hijacking, cross-site request forgery, DOM manipulation, and phishing attacks.

Users are advised to update to efw4.X version 4.08.010 or later, where this vulnerability has been fixed.