Critical · published February 4, 2026
🚨 WebERP 4.15.1 has a sneaky little flaw that lets attackers access your database backups—no authentication required! 😱 Think of this as leaving your sensitive documents in the lobby for anyone to grab—no keycard needed. Just request the right file, and voilà! An attacker could easily download sensitive database backup files, potentially exposing critical information about your business, customers, and operations. This could lead to data leaks, loss of customer trust, and even legal repercussions. The consequences are absolutely devastating!
Think of this as leaving your sensitive documents in the lobby for anyone to grab—no keycard needed. Just request the right file, and voilà! This vulnerability allows unauthenticated remote access to backup files stored in the 'companies/weberp/' directory. By simply requesting a specific file, attackers can download sensitive data without any authentication checks.
An attacker could easily download sensitive database backup files, potentially exposing critical information about your business, customers, and operations. This could lead to data leaks, loss of customer trust, and even legal repercussions. The consequences are absolutely devastating! Immediately upgrade to WebERP 4.15.2 or later to patch this vulnerability. Also, consider restricting access to the backup directory and implementing proper authentication mechanisms to secure sensitive files. Don't leave your door wide open! You've got this! Follow these steps, and you’ll lock down your system tighter than ever! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| weberp/weberp | all versions | — |