SMEWebify WebErpMesv2 up to 1.19 File Upload scan_file input validation

Summaryinfo

A vulnerability categorized as critical has been discovered in SMEWebify WebErpMesv2 up to 1.19. Affected is an unknown function of the component File Upload. Such manipulation of the argument scan_file leads to input validation. This vulnerability is uniquely identified as CVE-2026-49827. The attack can be launched remotely. No exploit exists.

Detailsinfo

A vulnerability, which was classified as critical, has been found in SMEWebify WebErpMesv2 up to 1.19. Affected by this issue is an unknown functionality of the component File Upload. The manipulation of the argument scan_file with an unknown input leads to a input validation vulnerability. Using CWE to declare the problem leads to CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. Impacted is confidentiality, integrity, and availability. CVE summarizes:

WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Versions 1.19 and prior allow any self-registered user to upload arbitrary PHP files through the HR Expense scan_file parameter, leading to Remote Code Execution. Combined with open registration (no invite required) and broken role middleware (CheckUserRole silently swallows RouteNotFoundException), this chain is effectively unauthenticated RCE against any default installation. The issue is patched in commit 5c54862fa044b363fd2be03d586750e81afd6818.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-49827 since 06/01/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. There are known technical details, but no exploit is available.

Applying the patch 5c54862fa044b363fd2be03d586750e81afd6818 is able to eliminate this problem.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• SMEWebify

Name

• WebErpMesv2

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11
• 1.12
• 1.13
• 1.14
• 1.15
• 1.16
• 1.17
• 1.18
• 1.19

Website

• Product: https://github.com/SMEWebify/WebErpMesv2/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion