What is the CVSS score of EUVD-2026-52648?

EUVD-2026-52648 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of HUMANIST Digital HR are affected by EUVD-2026-52648?

Bilin Software HUMANIST versions 26.0-26.1 contain a critical vulnerability allowing any remote attacker to upload malicious files and execute commands on your HR server without credentials.. A patch is available.

How to fix or mitigate EUVD-2026-52648?

Within 24 hours, immediately disable the file upload functionality in HUMANIST versions 26.0-26.1 via configuration, or take the application offline; simultaneously restrict network access to the application through firewall rules to limit exposure to authorized internal IP addresses only. Within 7 days, contact Bilin Software support for emergency patching guidance or a workaround; review server logs and file-upload directories for any suspicious activity or unauthorized files since deployment and preserve logs for forensic analysis. Within 30 days, apply the vendor patch immediately upon release; conduct a thorough security investigation of the affected server, including user activity logs and file system integrity, to confirm no unauthorized access has occurred.

HUMANIST Digital HR EUVD-2026-52648

| CVE-2026-14175 CRITICAL

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-08-04 TR-CERT

GHSA-75vh-8xgg-597q

File Upload Humanist Digital Human Resources

9.8

CVSS 3.1 · Vendor: TR-CERT

Severity by source

Vendor (TR-CERT) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated network-reachable upload with no user interaction yields code execution and full CIA loss, so AV:N/AC:L/PR:N/UI:N and C/I/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (TR-CERT).

CVSS VectorVendor: TR-CERT

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Aug 04, 2026 - 10:01 EUVD

Analysis Generated

Aug 04, 2026 - 09:52 vuln.today

CVE Published

Aug 04, 2026 - 08:23 cve.org

CRITICAL 9.8

DescriptionCVE.org

Unrestricted upload of file with dangerous type vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Upload a Web Shell to a Web Server.

This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1.

AnalysisAI

Remote code execution in Bilin Software HUMANIST Digital Human Resources versions 26.0 through 26.1 allows unauthenticated attackers to upload a web shell to the server due to unrestricted file-type validation (CWE-434), resulting in full compromise of the HR application host. Any remote attacker can reach the upload functionality without credentials or user interaction and execute arbitrary commands. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Reach exposed HUMANIST upload endpoint

Delivery

Submit disguised web shell file

Exploit

Bypass missing file-type validation

Execution

Request uploaded shell URL

Persist

Execute commands as service account

Impact

Full server compromise

Access

Reach exposed HUMANIST upload endpoint

Delivery

Submit disguised web shell file

Exploit

Bypass missing file-type validation

Execution

Request uploaded shell URL

Persist

Execute commands as service account

Impact

Full server compromise

Vulnerability AssessmentAI

Exploitation	The specific prerequisite is network reachability of the HUMANIST Digital Human Resources file-upload feature on a vulnerable instance in the 26.0-to-before-26.1 range; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) there are no special conditions - remote unauthenticated exploitation against default configurations of HUMANIST Digital Human Resources with no user interaction. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The signals are consistent and point to genuine high priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An unauthenticated attacker reaches the HUMANIST HR file-upload feature over the network and submits a malicious server-side script disguised as or alongside a permitted document type. Because the application does not restrict dangerous file types, the file lands in a web-accessible path; the attacker then requests its URL, causing the server to execute the web shell and yield remote command execution as the application service account. …
Remediation	Upgrade HUMANIST Digital Human Resources to version 26.1 or later, which is the first release outside the affected range and is treated as the fixed version; confirm the exact patched build directly with Bilin Software and review the TR-CERT advisory at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0737 for vendor guidance. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, immediately disable the file upload functionality in HUMANIST versions 26.0-26.1 via configuration, or take the application offline; simultaneously restrict network access to the application through firewall rules to limit exposure to authorized internal IP addresses only. …

Threat intelligence, references, and detailed analysis are available after sign-in.