The vulnerability lies in the elfinder_paste functionality of efw4.X. Before version 4.08.010 the elfinder_checkRisk routine filters path traversal on the target parameter but ignores the dst (destination) value. An attacker can supply a base64‑encoded traversal string as dst, causing the application to copy or move files from the protected home directory to an arbitrary location on the server. This bypasses the protected=true security check, giving the attacker write access to files that can be leveraged for remote code execution. The weakness is classified as CWE‑78.

efwGrp’s efw4.X web framework versions earlier than 4.08.010 are vulnerable. The issue is present from the initial release through 4.08.009; the advisory specifies that the 4.08.010 release contains the fix. Systems running any of these versions should be considered at risk until upgraded.

The CVSS score of 9.3 marks the flaw as critical, and although the EPSS score is unavailable, the lack of KEV listing today does not reduce the practical risk. Based on the description it is inferred that the attacker can trigger the vulnerability via the web interface; an unauthenticated or authenticated user with access to the elfinder_paste endpoint could exploit it remotely. The exploitation path requires only the ability to send a crafted request to elfinder_paste with a base64‑encoded dst parameter, making it relatively straightforward to automate once the endpoint is discovered.