External risk intelligence

WebErpMesv2 Unauthenticated Remote Code Execution via Arbitrary File Upload

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-49827

The application is a web-based Resource Management and Manufacturing execution system. Such systems are commonly deployed as internet-facing web applications to facilitate remote access for employees, suppliers, or management, making them reachable via standard web browsers and protocols.

Missing Authentication

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in WebErpMesv2, an industrial resource management and manufacturing execution system. This flaw allows for unauthenticated remote code execution, meaning an attacker could potentially gain control of affected systems without needing any credentials. This impacts systems that are not yet updated to address the issue.

Unauthenticated attackers can execute code remotely.
Critical vulnerability in industrial control system.
Confirm relevance and confirm exposure to this threat.

Attack Path

How an attacker could exploit the issue

An attacker can initiate a campaign by exploiting a vulnerability in the WebErpMesv2 system, which is a web-based manufacturing and resource management tool. The system's open registration and flawed security checks allow an unauthenticated attacker to upload malicious PHP files. This upload is facilitated through the `HR Expense scan_file` parameter, bypassing intended security controls and ultimately leading to the execution of arbitrary code on the server.

No authentication required for initial access.
Upload arbitrary PHP files via a specific parameter.
Achieves unauthenticated Remote Code Execution.

Live Threat

Current exploitation, exposure, and threat context

A self-registered user could upload arbitrary PHP files, potentially leading to unauthenticated remote code execution on systems with default configurations and no additional security measures. This could affect the integrity and availability of the manufacturing execution system.

System data and code.
Uploading malicious PHP files.
Unauthorized system access and control.

Operational Fix

Recommended remediation, mitigation, and detection steps

Given that WebErpMesv2 is a web-based manufacturing execution system, application owners and platform teams are likely responsible for addressing this vulnerability. The initial practical step involves identifying all instances of WebErpMesv2 within the environment, determining their reachability and business criticality, and then locating the accountable owner to initiate a risk-based remediation plan.

Application owners should take ownership.
Verify external exposure and reachability first.
Plan remediation based on business impact.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is WebErpMesv2?

WebErpMesv2 is a web-based software platform designed for Resource Management and Manufacturing execution. It helps industrial organizations track and manage internal operations, such as employee expenses and resource allocation, through a centralized browser-based interface.

How does CVE-2026-49827 allow remote code execution?

This vulnerability involves an Unrestricted Upload of File with Dangerous Type (CWE-434) and Missing Authentication for Critical Function (CWE-306). Because the system incorrectly validates user inputs and fails to enforce role-based access, an attacker can upload malicious PHP scripts through the HR Expense module and execute them directly on the host server.

What actions trigger this vulnerability?

The flaw is triggered when an attacker accesses the HR Expense feature and uses the scan_file parameter to upload a file. While the system requires specific configuration flaws to be fully exploited—specifically the open registration feature and bypassed middleware checks—standard authenticated sessions are not required to initiate this malicious upload process.

Is my instance of WebErpMesv2 at risk?

Halo Surface Signal indicates that because WebErpMesv2 is a web-based management tool, it is frequently deployed as an internet-facing application to support remote access. If your installation is reachable via the public internet, it faces a higher likelihood of exposure to external threats compared to systems restricted to internal networks.

How do I secure my system against this threat?

Your first step is to locate all instances of WebErpMesv2 in your environment and verify if they are running a vulnerable version. To remediate the issue, you must apply the official patch provided in commit 5c54862fa044b363fd2be03d586750e81afd6818, which resolves the file upload and authentication weaknesses.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.