WebErpMesv2 v1.18 and earlier allow authenticated users to upload arbitrary files due to a bypass of the file‑type validation in several controllers. An attacker can upload a PHP script or other executable file, which is then processed by the web server, resulting in remote code execution. The flaw is an example of unrestricted file upload (CWE‑434) and a failure to validate the file’s domain or type (CWE‑616). Successful exploitation permits code execution with the privileges of the web application, potentially compromising the host, stealing data, or disrupting operations.

Vendor SMEWebify’s WebErpMesv2 product is affected in all releases before 1.19. The vulnerability exists in version 1.18 and earlier, and was addressed in the 1.19 release.

The CVSS score of 5.4 indicates moderate severity, largely because the flaw has an authentication requirement. The EPSS score of less than 1% suggests that, historically, exploitation attempts are rare. The vulnerability is not yet listed in the CISA KEV catalog. Attackers need valid credentials to reach the upload endpoint, and the web server must be configured to execute uploaded PHP files. Because the flaw remains dormant until an authenticated user uploads a malicious file, the exposure is limited to systems that allow user logins and file uploads, but the impact of a successful attack would be full system compromise.