CVE-2026-22789

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-22789", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-09T18:27:19.388Z", "datePublished": "2026-01-12T21:52:11.880Z", "dateUpdated": "2026-01-13T19:41:31.721Z"}, "containers": {"cna": {"title": "WebErpMesv2 has a File Upload Validation Bypass Leading to RCE", "problemTypes": [{"descriptions": [{"cweId": "CWE-434", "lang": "en", "description": "CWE-434: Unrestricted Upload of File with Dangerous Type", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-616", "lang": "en", "description": "CWE-616: Incomplete Identification of Uploaded File Variables (PHP)", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/SMEWebify/WebErpMesv2/security/advisories/GHSA-64rv-f829-x6m4", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/SMEWebify/WebErpMesv2/security/advisories/GHSA-64rv-f829-x6m4"}, {"name": "https://github.com/SMEWebify/WebErpMesv2/commit/c9e7f4a85aeb774a0ea4b61ad57a51b941166b69", "tags": ["x_refsource_MISC"], "url": "https://github.com/SMEWebify/WebErpMesv2/commit/c9e7f4a85aeb774a0ea4b61ad57a51b941166b69"}], "affected": [{"vendor": "SMEWebify", "product": "WebErpMesv2", "versions": [{"version": "< 1.19", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-12T21:52:11.880Z"}, "descriptions": [{"lang": "en", "value": "WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Prior to 1.19, WebErpMesv2 contains a file upload validation bypass vulnerability in multiple controllers that allows authenticated users to upload arbitrary files, including PHP scripts, leading to Remote Code Execution (RCE). This vulnerability is identical in nature to CVE-2025-52130 but exists in different code locations that were not addressed by the original fix. This vulnerability is fixed in 1.19."}], "source": {"advisory": "GHSA-64rv-f829-x6m4", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/SMEWebify/WebErpMesv2/security/advisories/GHSA-64rv-f829-x6m4", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-13T19:41:26.669967Z", "id": "CVE-2026-22789", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-13T19:41:31.721Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "WebErpMesv2 has a File Upload Validation Bypass Leading to RCE", "source": {"advisory": "GHSA-64rv-f829-x6m4", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "SMEWebify", "product": "WebErpMesv2", "versions": [{"status": "affected", "version": "< 1.19"}]}], "references": [{"url": "https://github.com/SMEWebify/WebErpMesv2/security/advisories/GHSA-64rv-f829-x6m4", "name": "https://github.com/SMEWebify/WebErpMesv2/security/advisories/GHSA-64rv-f829-x6m4", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/SMEWebify/WebErpMesv2/commit/c9e7f4a85aeb774a0ea4b61ad57a51b941166b69", "name": "https://github.com/SMEWebify/WebErpMesv2/commit/c9e7f4a85aeb774a0ea4b61ad57a51b941166b69", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Prior to 1.19, WebErpMesv2 contains a file upload validation bypass vulnerability in multiple controllers that allows authenticated users to upload arbitrary files, including PHP scripts, leading to Remote Code Execution (RCE). This vulnerability is identical in nature to CVE-2025-52130 but exists in different code locations that were not addressed by the original fix. This vulnerability is fixed in 1.19."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-434", "description": "CWE-434: Unrestricted Upload of File with Dangerous Type"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-616", "description": "CWE-616: Incomplete Identification of Uploaded File Variables (PHP)"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-12T21:52:11.880Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-22789", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-13T19:41:26.669967Z"}}}], "references": [{"url": "https://github.com/SMEWebify/WebErpMesv2/security/advisories/GHSA-64rv-f829-x6m4", "tags": ["exploit"]}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-01-13T19:41:21.956Z"}}]}, "cveMetadata": {"cveId": "CVE-2026-22789", "state": "PUBLISHED", "dateUpdated": "2026-01-12T21:52:11.880Z", "dateReserved": "2026-01-09T18:27:19.388Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-12T21:52:11.880Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "WebErpMesv2", "vendor": "SMEWebify", "versions": [{"status": "affected", "version": "< 1.19"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:wem-project:wem:1.18:*:*:*:*:*:*:*", "matchCriteriaId": "647BD812-98EF-4CEA-8C31-C401DECD1031", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Prior to 1.19, WebErpMesv2 contains a file upload validation bypass vulnerability in multiple controllers that allows authenticated users to upload arbitrary files, including PHP scripts, leading to Remote Code Execution (RCE). This vulnerability is identical in nature to CVE-2025-52130 but exists in different code locations that were not addressed by the original fix. This vulnerability is fixed in 1.19."}, {"lang": "es", "value": "WebErpMesv2 es un sistema web de gesti\u00f3n de recursos y ejecuci\u00f3n de fabricaci\u00f3n para la industria. Antes de la versi\u00f3n 1.19, WebErpMesv2 contiene una vulnerabilidad de omisi\u00f3n de validaci\u00f3n de carga de archivos en m\u00faltiples controladores que permite a los usuarios autenticados cargar archivos arbitrarios, incluyendo scripts PHP, lo que lleva a la ejecuci\u00f3n remota de c\u00f3digo (RCE). Esta vulnerabilidad es id\u00e9ntica en naturaleza a CVE-2025-52130 pero existe en diferentes ubicaciones de c\u00f3digo que no fueron abordadas por la correcci\u00f3n original. Esta vulnerabilidad se corrigi\u00f3 en la versi\u00f3n 1.19."}], "id": "CVE-2026-22789", "lastModified": "2026-06-17T10:20:25.863", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.5, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-22789", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-13T19:41:26.669967Z", "version": "2.0.3"}}]}, "published": "2026-01-12T22:16:08.490", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/SMEWebify/WebErpMesv2/commit/c9e7f4a85aeb774a0ea4b61ad57a51b941166b69"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/SMEWebify/WebErpMesv2/security/advisories/GHSA-64rv-f829-x6m4"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Vendor Advisory"], "url": "https://github.com/SMEWebify/WebErpMesv2/security/advisories/GHSA-64rv-f829-x6m4"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-434"}, {"lang": "en", "value": "CWE-616"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-434"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T06:57:45.430834+00:00", "value": {"mitigation_remediation": ["Upgrade to WebErpMesv2 1.19 or later to eliminate the file upload validation bypass.", "If an upgrade cannot be performed immediately, restrict the upload directory to non\u2011executable file types, enforce a strict whitelist of allowed MIME types, and block execution of uploaded files.", "Disable the file upload feature for users who do not require it, applying the principle of least privilege.", "Verify that the web server does not treat the upload directory as a web\u2011executable location, and configure it to serve uploads as static content only."], "summary": {"action": "Patch Now", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "Vendor SMEWebify\u2019s WebErpMesv2 product is affected in all releases before 1.19. The vulnerability exists in version 1.18 and earlier, and was addressed in the 1.19 release.", "description_and_impact": "WebErpMesv2 v1.18 and earlier allow authenticated users to upload arbitrary files due to a bypass of the file\u2011type validation in several controllers. An attacker can upload a PHP script or other executable file, which is then processed by the web server, resulting in remote code execution. The flaw is an example of unrestricted file upload (CWE\u2011434) and a failure to validate the file\u2019s domain or type (CWE\u2011616). Successful exploitation permits code execution with the privileges of the web application, potentially compromising the host, stealing data, or disrupting operations.", "risk_and_exploitability": "The CVSS score of 5.4 indicates moderate severity, largely because the flaw has an authentication requirement. The EPSS score of less than 1% suggests that, historically, exploitation attempts are rare. The vulnerability is not yet listed in the CISA KEV catalog. Attackers need valid credentials to reach the upload endpoint, and the web server must be configured to execute uploaded PHP files. Because the flaw remains dormant until an authenticated user uploads a malicious file, the exposure is limited to systems that allow user logins and file uploads, but the impact of a successful attack would be full system compromise."}}}}, "created": "2026-04-18T07:00:11.354273+00:00", "updated": "2026-04-18T07:00:11.354291+00:00", "vendors": []}