What is CVE-2026-22789?

CVE-2026-22789 is a medium-severity vulnerability in Smewebify Weberpmesv2, classified under Unrestricted Upload of File with Dangerous Type. CVSS score: 5.4/10. Published 2026-01-12.

How severe is CVE-2026-22789?

Medium severity. CVSS v3 base score is 5.4 out of 10.

Arbitrary file upload in Smewebify Weberpmesv2

CVE-2026-22789

WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Prior to 1.19, WebErpMesv2 contains a file upload validation bypass vulnerability in multiple controllers that allows authenticated users to upload arbitrary files, including PHP scripts, leading to Remote Code Execution (RCE). This vulnerability is identical in nature to CVE-2025-52130 but exists in different code locations that were not addressed by the original fix. This vulnerability is fixed in 1.19.

Vulnerability class: Unrestricted File Upload

EPSS: 0.002 (13.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N.

Affected products

Smewebify Weberpmesv2 — versions < 1.19
Wem-project Wem — versions 1.18

Weakness classification (CWE)

References

security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
security-advisories@github.com (Patch, x_refsource_MISC)

Frequently asked questions

What is CVE-2026-22789?: CVE-2026-22789 is a medium-severity vulnerability in Smewebify Weberpmesv2, classified under Unrestricted Upload of File with Dangerous Type. CVSS score: 5.4/10. Published 2026-01-12.
How severe is CVE-2026-22789?: Medium severity. CVSS v3 base score is 5.4 out of 10.