AUGUST 14, 2026
Live Feed
Back to database
Case File

CVE-2026-49827

CRITICAL · CVSS 9.8 EPSS 0.48% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-08-13 · Last synced 2026-08-14

CyberRota Analysis

AI-Generated

Versions 1.19 and earlier of WebErpMesv2 are vulnerable to unauthenticated remote code execution due to improper handling of file uploads, allowing self-registered users to upload arbitrary PHP files. This critical vulnerability arises from open registration and inadequate role management, posing a significant risk to any default installation. Organizations using this system should prioritize applying the patch to mitigate potential exploitation.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

Detected Signals
remote code execution code execution

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-49827
Severity
CRITICAL
CVSS
9.8
EPSS
0.48%

Original NVD Description

WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Versions 1.19 and prior allow any self-registered user to upload arbitrary PHP files through the HR Expense scan_file parameter, leading to Remote Code Execution. Combined with open registration (no invite required) and broken role middleware (CheckUserRole silently swallows RouteNotFoundException), this chain is effectively unauthenticated RCE against any default installation. The issue is patched in commit 5c54862fa044b363fd2be03d586750e81afd6818.