TI-2026-18307 Aliases CVE-2026-22789

WebErpMesv2 has a File Upload Validation Bypass Leading to RCE

HIGH 71CWE-434Published 2026-01-12 · Updated 2026-01-13

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-434.

Summary

WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Prior to 1.19, WebErpMesv2 contains a file upload validation bypass vulnerability in multiple controllers that allows authenticated users to upload arbitrary files, including PHP scripts, leading to Remote Code Execution (RCE). This vulnerability is identical in nature to CVE-2025-52130 but exists in different code locations that were not addressed by the original fix. This vulnerability is fixed in 1.19.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00273 19th percentileScored 2026-11-07

Fix Fixed WebErpMesv2 (SMEWebify): 1.19

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
SMEWebify	WebErpMesv2	before 1.19	1.19	Patch available	CNA

WebErpMesv2 VendorSMEWebify Affected before 1.19 Fixed in 1.19 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:wem-project:wem:1.18:::::::*	1.18	Vulnerable	Wem-project

cpe:2.3:a:wem-project:wem:1.18:*:*:*:*:*:*:* Versions 1.18 Vulnerable ·Wem-project

Remediation

Fix · CNA WebErpMesv2 (SMEWebify) Fixed in 1.19

Timeline

2026-10-02 Threatist record created from CVE-2026-22789

References

Patch 1

https://github.com/SMEWebify/WebErpMesv2/commit/c9e7f4a85aeb774a0ea4b61ad57a51b941166b69

Advisory 1

https://github.com/SMEWebify/WebErpMesv2/security/advisories/GHSA-64rv-f829-x6m4

TI-2026-36733 WebErpMesv2 has Unauthenticated RCE via Unrestricted File Upload in HR Expense scan_file (CWE-434) CVSS 3.1CRITICAL 9.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences