HUMANIST Digital HR CVE-2026-14175

The specific prerequisite is network reachability of the HUMANIST Digital Human Resources file-upload feature on a vulnerable instance in the 26.0-to-before-26.1 range; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) there are no special conditions - remote unauthenticated exploitation against default configurations of HUMANIST Digital Human Resources with no user interaction. The primary limiting factor is exposure: exploitation requires the attacker to be able to reach the upload endpoint, so instances behind VPN, IP allowlists, or internal-only segmentation are substantially harder to hit, and the product's limited, region-specific deployment narrows the pool of targets.

The signals are consistent and point to genuine high priority. The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H describes network-reachable, low-complexity, unauthenticated exploitation with no user interaction and full CIA impact - the worst realistic profile short of a scope change. There is no CISA KEV listing (the product is a regional/niche HR system unlikely to appear in KEV) and no EPSS score or POC was provided, so exploitation-probability data is missing rather than reassuring. The one limiting factor tempering real-world risk is prevalence: this is a specialized Turkish-market product with a small deployment footprint, so exploitation is more likely to be targeted than mass-scanned. Overall, treat as critical for any organization running the product; the absence of EPSS/POC data should not be read as low risk given the trivial exploitation conditions.

An unauthenticated attacker reaches the HUMANIST HR file-upload feature over the network and submits a malicious server-side script disguised as or alongside a permitted document type. Because the application does not restrict dangerous file types, the file lands in a web-accessible path; the attacker then requests its URL, causing the server to execute the web shell and yield remote command execution as the application service account. No POC has been published, but the low-complexity, no-authentication vector makes weaponization straightforward for an attacker who can access the interface.