CVE-2026-49827 PUBLISHED

WebErpMesv2 has Unauthenticated RCE via Unrestricted File Upload in HR Expense scan_file (CWE-434)

Assigner: GitHub_M
Reserved: 01.06.2026 Published: 13.08.2026 Updated: 13.08.2026

WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Versions 1.19 and prior allow any self-registered user to upload arbitrary PHP files through the HR Expense scan_file parameter, leading to Remote Code Execution. Combined with open registration (no invite required) and broken role middleware (CheckUserRole silently swallows RouteNotFoundException), this chain is effectively unauthenticated RCE against any default installation. The issue is patched in commit 5c54862fa044b363fd2be03d586750e81afd6818.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 9.8

Product Status

Vendor SMEWebify
Product WebErpMesv2
Versions
  • Version <= 1.19 is affected

References

Problem Types

  • CWE-20: Improper Input Validation CWE
  • CWE-306: Missing Authentication for Critical Function CWE
  • CWE-434: Unrestricted Upload of File with Dangerous Type CWE