File Upload Validation Bypass in WebErpMesv2 Resource Management System by SMEWebify
CVE-2026-22789

5.4MEDIUM

Key Information:

Vendor

Smewebify

Status
Weberpmesv2
Vendor
CVE Published:
12 January 2026

What is CVE-2026-22789?

WebErpMesv2, a resource management and manufacturing execution system by SMEWebify, is susceptible to a file upload validation bypass vulnerability prior to version 1.19. This flaw allows authenticated users to upload arbitrary files, including potentially malicious PHP scripts. Such an exploit can lead to remote code execution (RCE), posing severe security risks. This vulnerability shares similarities with a previously identified issue but is found in different sections of the codebase that were not addressed by prior fixes. Users are strongly encouraged to update to version 1.19 or later to mitigate the risks associated with this vulnerability.

Affected Version(s)

WebErpMesv2 < 1.19

References

https://github.com/SMEWebify/WebErpMesv2/security/advisor...
x_refsource_CONFIRM
https://github.com/SMEWebify/WebErpMesv2/commit/c9e7f4a85...
x_refsource_MISC

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.