The vulnerability arises from efw4.X’s unZip method which writes extracted files directly to disk using the raw zip entry names. The flaw is a classic directory traversal vulnerability (CWE-77). A crafted entry such as '../../../pwned.jsp' allows the file to be created outside the intended extraction folder, including inside the web application’s context root. When this flaw is combined with the framework’s uploadServlet, which triggers file.saveUploadFiles followed by unZip, a remote attacker who can upload a file—even without authentication—can drop a malicious JSP webshell into the Tomcat webapps directory and execute arbitrary commands with the Tomcat process’s privileges.

efwGrp efw4.X versions prior to 4.08.010 are affected. The issue is fixed in 4.08.010 and later releases.

The CVSS score of 9.3 marks this as critical. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog, but the lack of authentication on the upload endpoint and the ability to write executable content make exploitation highly likely once an attacker can reach the endpoint. Attackers can achieve full control of the host as the Tomcat user.