WebErpMesv2 versions 1.19 and prior allow arbitrary PHP file uploads through the HR Expense scan_file parameter, leading to Remote Code Execution. The vulnerability is exploitable by any self-registered user due to open registration (no invite required) combined with broken role middleware (CheckUserRole silently swallows RouteNotFoundException), making this effectively unauthenticated RCE against default installations.
An unauthenticated attacker can register a user account and upload arbitrary PHP files through the HR Expense scan_file parameter to execute arbitrary code on the server with the privileges of the web application process.
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
Available (commit 5c54862fa044b363fd2be03d586750e81afd6818)
Upgrade WebErpMesv2 to a version after 1.19 that includes the patch. In the interim, restrict access to the HR Expense module, disable user self-registration, implement strict file upload validation with whitelist of allowed file types, and fix the CheckUserRole middleware to properly enforce role-based access controls.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD published the first details for CVE-2026-49827
A CVSS base score of 9.8 has been assigned.
Feedly found the first article mentioning CVE-2026-49827 . See article
Critical RCE Vulnerability in WebErpMesv2 Affects Self-Registered Users
CVE-2026-49827 - Exploits & Severity - Feedly
WebErpMesv2 Critical RCE via Unauthenticated PHP File Upload
CVE-2026-49827 | SMEWebify WebErpMesv2 up to 1.19 File Upload scan_file input validation
Collect, analyze, and vulnerability reports faster using AI
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
