EUVD-2026-69094
GHSA-8prp-crp6-j4pj
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network file upload to a web-executable path yields RCE (PR:N/UI:N/AC:L); code execution beyond the app boundary justifies S:C with full C/I/A impact.
Primary rating from Vendor (CERT-In).
CVSS VectorVendor: CERT-In
Lifecycle Timeline
2DescriptionCVE.org
This vulnerability exists in the ERP system due to improper authentication controls and inadequate file type validation at the API endpoint. An unauthenticated remote attacker could exploit this vulnerability by uploading arbitrary files to a web accessible directory on the targeted system
Successful exploitation of this vulnerability could allow the attacker to execute arbitrary code and compromise the targeted system.
AnalysisAI
Unauthenticated remote code execution in Manacle Technologies' Multi-Tenant ERP System allows attackers to upload arbitrary files to a web-accessible directory via an API endpoint that lacks both authentication and file-type validation. Any remote attacker can drop a server-side executable (e.g., a web shell) and run arbitrary code, fully compromising the host. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network reachability to the ERP application's file-upload API endpoint and that the upload target directory be web-accessible with script execution enabled - both are the default/design condition described in the CVE. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Every signal that is present points to top-tier priority: the CVSS 4.0 base is 10.0 with AV:N/AC:L/AT:N/PR:N/UI:N and full high impact to both the vulnerable and subsequent systems (VC/VI/VA and SC/SI/SA all High), meaning network-reachable, low-complexity, unauthenticated exploitation with no user interaction and a scope-crossing impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch version is identified in the available data, so no fixed release can be cited - consult CERT-In advisory CIVN-2026-0430 (https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2026-0430) and Manacle Technologies for an official update and apply it as the primary fix once released. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Determine if your organization uses Manacle Technologies' Multi-Tenant ERP System; if yes, immediately isolate systems from the internet or implement strict firewall rules restricting access to the vulnerable API endpoint, and identify all affected instances. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Multi Tenant Erp System
View allSource code disclosure in Manacle Technologies' Multi-Tenant ERP System allows unauthenticated remote attackers to recon
Sensitive-data exposure in Manacle Technologies' Multi-Tenant ERP System allows an unauthenticated remote attacker to re
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today