CVE-2026-49827 in WebErpMesv2
Summary
by MITRE • 08/13/2026
WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Versions 1.19 and prior allow any self-registered user to upload arbitrary PHP files through the HR Expense scan_file parameter, leading to Remote Code Execution. Combined with open registration (no invite required) and broken role middleware (CheckUserRole silently swallows RouteNotFoundException), this chain is effectively unauthenticated RCE against any default installation. The issue is patched in commit 5c54862fa044b363fd2be03d586750e81afd6818.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/13/2026
This vulnerability exists within WebErpMesv2, a resource management and manufacturing execution system designed for industrial environments. The flaw manifests through an insecure file upload mechanism that allows any self-registered user to bypass authentication controls and execute arbitrary PHP code on the target server. The vulnerability specifically affects versions 1.19 and prior, with the issue being addressed in commit 5c54862fa044b363fd2be03d586750e81afd6818.
The technical implementation of this vulnerability stems from improper input validation within the HR Expense module's scan_file parameter. When users upload files through this interface, the system fails to properly validate file extensions or content types, allowing attackers to submit PHP files that get executed on the server. This represents a classic insecure file upload vulnerability that can be categorized under CWE-434, which specifically addresses the improper restriction of file uploads. The vulnerability is particularly dangerous because the application allows open registration with no invitation requirements, meaning any individual can create an account and immediately exploit this weakness.
The operational impact of this vulnerability is severe as it creates an effectively unauthenticated remote code execution chain that can be exploited against default installations. The broken role middleware component further compounds the issue, as CheckUserRole silently swallows RouteNotFoundException errors, allowing unauthorized users to bypass normal access controls. This combination means that any registered user can escalate their privileges and gain full server control without requiring additional authentication mechanisms. From an attacker's perspective, this vulnerability aligns with ATT&CK technique T1566.001 for initial access through spearphishing attachments and T1059.007 for command and scripting interpreter using PowerShell or PHP.
The security implications extend beyond simple code execution as this vulnerability can be leveraged for complete system compromise, data exfiltration, and lateral movement within industrial networks. Given that WebErpMesv2 is designed for manufacturing environments, successful exploitation could lead to operational technology disruption, intellectual property theft, and potential safety hazards in industrial control systems. The fix implemented in the referenced commit addresses the core file upload validation issue while also strengthening authentication mechanisms to prevent unauthorized access through the broken middleware component.
Organizations using affected versions should immediately implement mitigations including disabling unnecessary file upload functionality, implementing strict file type validation, and enforcing proper access controls. Network segmentation and monitoring for suspicious file upload activities can help detect exploitation attempts. The vulnerability demonstrates the critical importance of secure coding practices, particularly around input validation and authentication mechanisms, as highlighted in OWASP Top Ten 2021 category A05: Security Misconfiguration. Regular security assessments and code reviews should be conducted to prevent similar vulnerabilities from emerging in industrial control systems and enterprise resource planning applications.