CVE-2026-49827

Name of the Vulnerable Software and Affected Versions WebErpMesv2 versions prior to 1.20

Description WebErpMesv2 allows self-registered users to upload arbitrary PHP files via the scan file parameter in the HR Expense section, resulting in Remote Code Execution (RCE). This is exacerbated by open registration and a failure in the role middleware where the CheckUserRole() function silently ignores RouteNotFoundException, effectively allowing unauthenticated RCE on default installations.

Recommendations Apply the fix provided in commit 5c54862fa044b363fd2be03d586750e81afd6818. Restrict access to the scan file parameter in the HR Expense section to minimize the risk of exploitation.