CVE-2026-49827CWE-20CWE-306CWE-434unrestricted-file-upload

CVE-2026-49827

Critical · published August 13, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
58.1
In the wild
Unconfirmed
What it is

WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Versions 1.19 and prior allow any self-registered user to upload arbitrary PHP files through the HR Expense scan_file parameter, leading to Remote Code Execution. Combined with open registration (no invite required) and broken role middleware (CheckUserRole silently swallows RouteNotFoundException), this chain is effectively unauthenticated RCE against any default installation. The issue is patched in commit 5c54862fa044b363fd2be03d586750e81afd6818.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00862 · 58.1th percentile
Weaknesses
CWE-20 · Improper Input Validation; CWE-306 · Missing Authentication for Critical Function; CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2026-08-13T17:19Z
References (2)
https://github.com/SMEWebify/WebErpMesv2/commit/5c54862fa044b363fd2be03d586750e81afd6818 · [email protected]https://github.com/SMEWebify/WebErpMesv2/security/advisories/GHSA-chhq-7p67-2ff9 · [email protected]
EPSS history
Timeline
  • 13 AUG 12:51Z
    WebErpMesv2 has Unauthenticated RCE via Unrestricted File Upload in HR Expense scan_file (CWE-434)
    cvelistv5