efw4.X versions before 4.08.010 contain an OS command injection vulnerability (CWE-78) due to improper validation of the 'dst' parameter in the elfinder_paste function. While the elfinder_checkRisk function validates 'target' and 'targets' parameters against path traversal and home directory containment, it does not validate 'dst'. An attacker can exploit this by setting 'dst' to a base64-encoded traversal path, enabling unauthorized file operations outside the intended directory scope and bypassing the protected=true control. This vulnerability is addressed in efw4.X version 4.08.010.

Successful exploitation allows an unauthenticated attacker to copy or move files from within the home directory to arbitrary locations on the system, bypassing security controls designed to restrict file operations. This can lead to unauthorized file manipulation and potential compromise of system integrity. The vulnerability has a CVSS 4.0 score of 9.3, reflecting high impact on confidentiality, integrity, and availability.

This vulnerability is fixed in efw4.X version 4.08.010. Users should upgrade to version 4.08.010 or later to remediate this issue. Patch status is not explicitly confirmed beyond this fix version; therefore, check the vendor advisory for the latest remediation guidance. No other mitigations are specified.