PT-2026-2308 · Unknown · Weberpmesv2

Nedlir · Published 2026-01-12 · Updated 2026-01-21 · CVE-2026-22789

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WebErpMesv2 versions prior to 1.19

Description WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Versions prior to 1.19 contain a file upload validation bypass in multiple controllers. This allows authenticated users to upload arbitrary files, including PHP scripts, potentially leading to Remote Code Execution (RCE). The issue is similar to another reported problem but exists in different code locations.

Recommendations Update to version 1.19 or later.

Exploit

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

CWE-616

Related Identifiers

CVE-2026-22789

GHSA-64RV-F829-X6M4

Affected Products

Weberpmesv2

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22789.json · Exploit
• 🔥 https://github.com/SMEWebify/WebErpMesv2/security/advisories/GHSA-64rv-f829-x6m4 · Exploit
• https://github.com/SMEWebify/WebErpMesv2/commit/c9e7f4a85aeb774a0ea4b61ad57a51b941166b69 · Patch
• https://osv.dev/vulnerability/CVE-2026-22789 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-22789 · Security Note
• https://twitter.com/VulmonFeeds/status/2010922038542713092 · Twitter Post
• https://t.me/cveNotify/149442 · Telegram Post
• https://twitter.com/CVEnew/status/2010838276996022601 · Twitter Post