CVE-2026-22789
Wem-Project Wem 1.18
Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:NSummary
CVE-2026-22789 is a medium-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Wem-Project Wem. Its CVSS base score is 5.4 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 15th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SI-3 (Malicious Code Protection) and CM-7 (Least Functionality) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-22789 is a file upload validation bypass vulnerability affecting WebErpMesv2, an open-source Resource Management and Manufacturing Execution System web application for industrial use. In versions prior to 1.19, multiple controllers fail to properly validate uploaded files, enabling authenticated users to upload arbitrary files, including malicious PHP scripts. This flaw leads to remote code execution (RCE) and is classified under CWE-434 (Unrestricted Upload of File with Dangerous Type) and CWE-616 (Incomplete Identification of Uploaded File Variables). The vulnerability mirrors CVE-2025-52130 in nature but impacts different code locations overlooked in the prior remediation, with a CVSS v3.1 base score of 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).
An attacker with low-privilege authenticated access (PR:L) can exploit this over the network (AV:N) with low complexity (AC:L) and without requiring user interaction (UI:N). By bypassing file validation in the affected controllers, they can upload and execute PHP scripts, achieving RCE on the server. The unchanged scope (S:U) limits lateral movement, while impacts are confined to low confidentiality and integrity effects (C:L/I:L) with no availability disruption (A:N).
Mitigation is available in WebErpMesv2 version 1.19, which addresses the issue via fixes in the referenced GitHub commit (c9e7f4a85aeb774a0ea4b61ad57a51b941166b69). The GitHub Security Advisory (GHSA-64rv-f829-x6m4) provides further details on the vulnerability and recommends upgrading immediately, along with reviewing access controls for file upload endpoints.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-1998
Vulnerability Data
WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Prior to 1.19, WebErpMesv2 contains a file upload validation bypass vulnerability in multiple controllers that allows authenticated users to upload arbitrary files, including PHP scripts, leading to Remote…
more
Code Execution (RCE). This vulnerability is identical in nature to CVE-2025-52130 but exists in different code locations that were not addressed by the original fix. This vulnerability is fixed in 1.19.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V5.1.1
Mitigating Controls (NIST 800-53 r5) AI
Malicious-code protection at entry points blocks dangerous file types from being accepted and executed.
Least functionality restricts the file types and automatic processing capabilities the system will accept.
Engineering principles such as complete mediation and least privilege require the use of the canonical $_FILES array rather than attacker-writable globals.
Mobile-code controls define, authorize, and block unacceptable uploaded code before automatic processing occurs.
Proper validation of all file-upload inputs stops attackers from supplying or overwriting the legacy global variables that the flawed code relies on.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Restricting execution of unauthorized software directly blocks dangerous uploaded files from running.
Secure SDLC practices directly prevent use of the deprecated PHP upload globals and variable-overwrite flaws.
Hardened configuration baselines can enforce allowed file types and processing rules.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Configuration and acceptance testing verify that file-upload handling enforces allowed types and does not permit dangerous content to be stored or executed.
Secure-coding guidelines and security testing explicitly address restrictions on allowed file types and upload handling, reducing the risk that dangerous file uploads are accepted without validation.
Application security requirements include secure file-upload mechanisms that eliminate reliance on the four legacy PHP variables.
Secure architecture principles discourage unsafe global state, indirectly reducing exposure to variable-injection attacks.
Secure coding explicitly prohibits use of deprecated upload variables and requires validated, server-side file handling.
Mandated testing for malicious content and known vulnerabilities reduces the likelihood that an outsourced component will contain or accept dangerous file types that could later be uploaded or executed.