What is the CVSS score of CVE-2026-49827?

CVE-2026-49827 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of WebErpMesv2 are affected by CVE-2026-49827?

WebErpMesv2 (SMEWebify) versions 1.19 and earlier contain a critical remote code execution vulnerability allowing unauthenticated attackers to upload and execute arbitrary PHP code through the HR…

How to fix or mitigate CVE-2026-49827?

Within 24 hours: Identify all systems running WebErpMesv2/SMEWebify version 1.19 or earlier; disable self-registration and revoke HR Expense module access to all non-administrative users; if possible, take vulnerable instances offline pending remediation. Within 7 days: Review server access logs and file system logs for unauthorized uploads to the public/file/Expense directory; scan for malicious PHP files; assess whether unauthorized code execution has occurred. Within 30 days: Deploy a Web Application Firewall (WAF) rule blocking all uploads through the scan_file parameter and configure the web server to prevent PHP execution in the public/file/Expense directory as temporary mitigations; monitor the vendor's advisory (GHSA-chhq-7p67-2ff9) for patch release and apply immediately when available.

WebErpMesv2 CVE-2026-49827

EUVD-2026-57830 CRITICAL

Improper Input Validation (CWE-20)

2026-08-13 security-advisories@github.com

PHP RCE

9.8

CVSS 3.1 · Vendor: github

Severity by source

Vendor (github) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Network-reachable upload with open self-registration and fail-open role middleware means no real privilege barrier (PR:N), low complexity, and arbitrary code execution yields full C/I/A loss.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Aug 13, 2026 - 13:42 vuln.today

Analysis Generated

Aug 13, 2026 - 13:42 vuln.today

CVE Published

Aug 13, 2026 - 13:19 cve.org

CRITICAL 9.8

DescriptionCVE.org

WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Versions 1.19 and prior allow any self-registered user to upload arbitrary PHP files through the HR Expense scan_file parameter, leading to Remote Code Execution. Combined with open registration (no invite required) and broken role middleware (CheckUserRole silently swallows RouteNotFoundException), this chain is effectively unauthenticated RCE against any default installation. The issue is patched in commit 5c54862fa044b363fd2be03d586750e81afd6818.

Articles & Coverage 1

News Critical RCE in WebErpMesv2 (SMEWebify) via File Upload - CVE-2026-49827 Aug 13, 2026

AnalysisAI

Remote code execution in WebErpMesv2 (SMEWebify) versions 1.19 and prior lets a self-registered user upload an arbitrary PHP file through the HR Expense 'scan_file' parameter, which the vulnerable HumanResourcesController wrote directly into the web-served public/file/Expense directory with no extension or MIME validation. Because registration is open (no invite) and the CheckUserRole middleware silently swallows RouteNotFoundException, the privilege barrier collapses into effectively unauthenticated RCE against a default install. There is no public exploit identified at time of analysis, but the GitHub Security Advisory (GHSA-chhq-7p67-2ff9) and fixing commit confirm the flaw and its exploitability.

Technical ContextAI

WebErpMesv2 is a PHP/Laravel-based Resource Management and Manufacturing Execution System for industrial SMEs. The root cause maps to CWE-20 (Improper Input Validation): the expense upload handler accepted any uploaded file, built a filename as time().'_'.getClientOriginalName(), and moved it via move(public_path('file/Expense'), ...) - an attacker-controlled name and extension landing inside the document root, so an uploaded .php file is directly executable by the web server. The fix rewrites this to store files on Laravel's local disk outside the web root using a UUID filename plus guessed extension (Storage::disk('local')->putFileAs('expenses', ...)), serves them through a controlled route restricted to image/PDF extensions, and adds strict validation (mimes/mimetypes jpeg,png,gif,pdf, max:10240) in StoreUserExpenseRequest. A parallel authorization defect in CheckUserRole (unhandled RouteNotFoundException when setup.index was absent) is corrected to abort(403) so users with no assigned role can no longer slip through.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - apply the changes from commit 5c54862fa044b363fd2be03d586750e81afd6818 (or upgrade to any release built after it, once tagged) which stores uploads outside the web root with UUID names, enforces mimes/mimetypes validation limited to jpeg/jpg/png/gif/pdf at max 10 MB, and fixes the CheckUserRole middleware to abort(403) instead of swallowing the routing exception; see https://github.com/SMEWebify/WebErpMesv2/security/advisories/GHSA-chhq-7p67-2ff9. If you cannot patch immediately, disable open self-registration so accounts require an invite/admin approval (removes the unauthenticated pre-condition but blocks legitimate self-onboarding), and configure the web server to deny PHP execution under the public/file/Expense upload directory (e.g. remove handler mapping / add a location rule) which stops code execution but not file storage, and restrict or remove access to the HR Expense upload endpoint for untrusted users.