EUVD-2026-40047
GHSA-jp75-xw64-hhmv
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CWE-434 unrestricted upload on an unauthenticated network endpoint typically yields webshell RCE, warranting S:C and C/I/A:H despite the reporter's conservative low-impact scores.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was determined in Hanwang e-Face General Management Platform 6.3.5.4. This issue affects some unknown processing of the file /manage/resourceUpload/upload.do. Executing a manipulation of the argument File can lead to unrestricted upload. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.
AnalysisAI
Unrestricted file upload in Hanwang e-Face General Management Platform 6.3.5.4 exposes unauthenticated remote attackers to arbitrary file upload via the /manage/resourceUpload/upload.do endpoint, with no input validation on file type or content per CWE-434. The CVSS 4.0 vector (PR:N, AC:L, AT:N) confirms the endpoint requires no authentication and is reachable over the network without special conditions. A publicly available proof-of-concept exploit has been disclosed via a Feishu wiki document, meaning exploitation tooling is accessible to low-skilled actors; this CVE is not yet listed in the CISA KEV catalog at time of analysis.
Technical ContextAI
The affected component is the resource upload handler at /manage/resourceUpload/upload.do within Hanwang's e-Face General Management Platform, a biometric identity and access control management solution (CPE: cpe:2.3:a:hanwang:e-face_general_management_platform:*:*:*:*:*:*:*:*). CWE-434 (Unrestricted Upload of File with Dangerous Type) describes a server-side failure to validate the MIME type, extension, or content of uploaded files, allowing an attacker to upload server-executable scripts such as JSP or PHP webshells. The platform appears to process the 'File' argument in the multipart upload request without enforcing allowlists or content inspection. If uploaded files land in a web-accessible directory and the application server processes the file extension for execution, this directly enables remote code execution. The CVSS 4.0 vector's low impact scores (VC:L/VI:L/VA:L) are inconsistent with typical CWE-434 outcomes and may reflect the reporter's conservative assessment or an environment where uploaded files are not directly served for execution.
RemediationAI
No vendor-released patch or advisory has been identified at time of analysis; no fix version is confirmed in the available data. Organizations running Hanwang e-Face General Management Platform should monitor the VulDB advisory at https://vuldb.com/vuln/374555 and Hanwang's official channels for a patch. As immediate compensating controls, restrict access to the /manage/resourceUpload/upload.do endpoint via network-layer ACLs or a web application firewall rule to trusted internal IP ranges only, which mitigates the unauthenticated remote attack vector but does not address insider threat or VPN-adjacent access. Additionally, configure the application server or underlying OS to deny execution of files in the upload destination directory (e.g., remove execute permissions or disable script processing for that path), which breaks the webshell execution chain even if an attacker successfully uploads a file. If the platform is internet-facing, consider taking it offline or placing it behind a VPN until a vendor patch is available, as the unauthenticated nature of the flaw makes perimeter exposure high-risk.
Same technique File Upload
View allShare
External POC / Exploit Code
Leaving vuln.today