CRITICALCVSS 9.8Vulnerability

CVE-2026-49827

WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Versions 1.19 and prior allow any self-registered user to upload arbitrary PHP files through the HR Expense scan_file parameter, leading to Remote Code Execution. Combined with open registration (no invite required) and broken role middleware (CheckUserRole silently swallows RouteNotFoundException), this chain is effectively unauthenticated RCE against any default installation. The issue is patched in commit 5c54862fa044b363fd2be03d586750e81afd6818.

Properties

Severity
CRITICAL
Cvss severity
CRITICAL
Cvss score
9.8
Epss score
0.00862
Retrieved at
2026-10-21T01:24:49+00:00
Last source
FIRST EPSS
Score
9.8
Cve id
CVE-2026-49827
Cvss vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
First seen by Signal
2026-09-18T21:50:18+00:00
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published at
2026-08-13T13:19:10.050
Last modified
2026-09-18T20:09:01.757
Epss percentile
0.57902

Related Entities (3)

HAS_WEAKNESS (3)

→[Weakness]Unrestricted Upload of File with Dangerous Type
→[Weakness]Missing Authentication for Critical Function
→[Weakness]Improper Input Validation

Explore deeper with Ninja Signal's threat intelligence graph

Search in SpektrOpen Signal Desktop
CVE-2026-49827 (CVSS 9.8) — Ninja Signal Threat Intelligence | Ninja Signal