CVE-2026-49827: WebErpMesv2 has Unauthenticated RCE via Unrestricted File Upload in HR Expense scan_file (CWE-434)
WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Versions 1.19 and prior allow any self-registered user to upload arbitrary PHP files through the HR Expense scanfile parameter, leading to Remote Code Execution. Combined with open registration (no invite required) and broken role middleware (CheckUserRole silently swallows RouteNotFoundException), this chain is effectively unauthenticated RCE against any default installation. The issue is patched in commit 5c54862fa044b363fd2be03d586750e81afd6818.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WebErpMesv2to a version that resolves this vulnerability.Patch 5c54862fa044b363fd2be03d586750e81afd6818
Event History
Frequently Asked Questions
What is the severity of CVE-2026-49827?
CVE-2026-49827 has a severity score of 9.8, classified as critical.
How does CVE-2026-49827 lead to remote code execution?
CVE-2026-49827 allows self-registered users to upload arbitrary PHP files, resulting in unauthenticated remote code execution.
Which versions of WebErpMesv2 are affected by CVE-2026-49827?
CVE-2026-49827 affects WebErpMesv2 versions 1.19 and prior.
How can I fix CVE-2026-49827?
To fix CVE-2026-49827, ensure that file uploads are restricted to safe file types and implement proper input validation.
Is there a workaround for CVE-2026-49827 until a patch is available?
The only effective workaround for CVE-2026-49827 is to disable file uploads until a security patch can be applied.