CVE-2026-14175: Critical Unrestricted File Upload in HUMANIST
TL;DR - CVE-2026-14175 is a critical unrestricted file upload flaw with CVSS 9.8. - HUMANIST Digital Human Resources 26.0 before 26.1 is affected; upgrade to 26.1. - No confirmed KEV-listed exploitation or verified public PoC is available from the cited primary sources, but defenders should treat web-shell upload risk as urgent.
Vulnerability at a Glance
| Field | Value |
|---|---|
| CVE ID | CVE-2026-14175 |
| CVSS | 9.8 Critical |
| Attack vector | Not explicitly provided in the retrieved primary-source data; defenders should assume remote exposure is possible if the upload feature is web-accessible |
| Privileges required | Unknown from the available primary sources |
| Patch available | Yes, fixed in version 26.1 |
The core issue is an unrestricted upload of a file with a dangerous type in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources. NVD states the impact plainly: an attacker can upload a web shell to a web server. In operational terms, that creates a credible path to server-side compromise, persistence, and post-exploitation activity.
A key limitation in the currently retrieved source material is that some implementation details are not published or were not exposed in accessible advisory text. That includes the exact vulnerable endpoint, whether authentication is required, and the full CVSS vector string. Where data is unknown, defenders should assume worst reasonable case for internet-facing deployments and prioritize exposure reduction and patching.
What Is This Vulnerability?
CVE-2026-14175 is classified as an unrestricted upload of file with dangerous type vulnerability. That class of flaw typically occurs when an application accepts uploaded content without sufficiently validating the file extension, MIME type, server-side content, storage path, or execution permissions. If the application stores user-supplied files in a location where the web server can execute them, an attacker can often turn a simple upload into remote code execution by placing a script or web shell on the server.
The NVD description is unusually direct about impact: the flaw allows upload of a web shell to a web server. That matters because a web shell is not merely a malicious document or inert artifact. It is usually a server-executable script that gives an attacker a command interface over HTTP or HTTPS. Once reachable, the shell can be used to run commands, browse files, dump credentials, alter application code, and establish persistence.
Because the available primary sources do not identify the exact file handling mistake, defenders should think in terms of common upload-control failures. Examples include trusting client-supplied MIME types, checking only the last extension, allowing dangerous file types such as .php, .jsp, .aspx, or .ashx, and placing uploads under a web root with script execution enabled. Even if the precise mechanism differs here, those are the control gaps most likely to produce the NVD-stated outcome.
A second practical concern is that file upload flaws often chain well with weak segregation on the server side. If the application account has broad filesystem access, an attacker who lands a shell may be able to pivot beyond the application directory. That is why even in the absence of confirmed in-the-wild exploitation, a dangerous upload flaw with stated web-shell impact should be treated as a top-tier remediation item.
Who Is Affected?
The affected product named in the NVD record is Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources. The affected version range is explicitly stated as “from 26.0 before 26.1.” In conventional version notation, that means >= 26.0 and < 26.1 are affected.
The same wording indicates that 26.1 is the first fixed version. If your installed version is 26.0, you should assume it is vulnerable. If you are on a release earlier than 26.1 within the affected branch identified by the vendor and NVD wording, you should also assume exposure until proven otherwise.
What remains unknown from the available primary sources is deployment nuance. The published data does not say whether the vulnerable upload functionality is exposed to all authenticated users, only administrators, HR personnel, or potentially unauthenticated users. It also does not say whether the vulnerable component is present in all installations or only in optional modules. In the absence of that detail, defenders should inventory all HUMANIST Digital Human Resources instances at version 26.0 and review any upload-capable workflows as potentially relevant.
If the application is internet-accessible, the urgency increases. Even when authentication requirements are unknown, externally reachable upload features are high-value targets. If the platform is internal-only, risk still remains because authenticated insiders, compromised VPN accounts, or lateral movement from another foothold can all make exploitation feasible.
CVSS Score Breakdown
The NVD data returned for this CVE confirms a CVSS v3.x base score of 9.8, which places the issue in the Critical severity tier. That score aligns with the stated impact of uploading a web shell to a web server, which strongly implies compromise of confidentiality, integrity, and availability if exploitation succeeds.
However, one important caveat is that the full CVSS vector string was not returned in the research material provided here. That means it would be inappropriate to invent or reverse-assert the exact metric values for attack complexity, privileges required, user interaction, scope, or impact components. A practitioner-grade assessment should be explicit about that uncertainty.
Even without the vector, the 9.8 score tells defenders this is not a minor input validation bug. In most environments, a file upload flaw that reaches web-shell deployment is operationally close to remote code execution on the application server. For that reason alone, security teams should prioritize this alongside other externally exploitable server-side vulnerabilities.
From a risk management perspective, the missing vector should not slow response. The practical controls are the same: identify exposed systems, patch to the fixed version, review for signs of malicious file uploads, and harden upload handling and web-executable directories. Where a vendor does not publish complete exploit prerequisites, defenders should default to a containment-first approach.
Exploitation Status
Based on the primary-source workflow and material provided, there is no confirmed CISA KEV listing for CVE-2026-14175. The research note explicitly states on_kev: false, so there is no CISA-confirmed evidence of exploitation in the wild at this time. That is a useful signal, but it is not proof of safety. KEV absence means only that CISA has not listed it as known exploited.
There is also no verified public proof-of-concept in the retrieved primary references. The NVD record and the referenced advisory material available in this workflow do not provide exploit code, request samples, or endpoint-level details that would let defenders confirm public weaponization. Therefore, the most accurate statement is: no verified public PoC is known from the available primary sources.
That said, defenders should not mistake “no confirmed PoC” for “hard to exploit.” Unrestricted file upload vulnerabilities are often straightforward to operationalize once the upload path is identified. Because the NVD impact already specifies web-shell upload, the exploitation concept is clear even if a polished public PoC is not. In practice, attackers commonly discover and abuse such flaws quickly when affected applications are exposed.
The right operational stance is measured urgency: patch quickly, hunt for indicators of malicious uploads, and review any internet-facing instances first. If additional threat intelligence later confirms exploitation, organizations that already patched and checked for uploaded shells will be in a much stronger position.
How to Detect It
Detection should focus on three areas: suspicious file uploads, suspicious web requests to newly uploaded scripts, and unexpected file creation in web-accessible directories. Because the exact endpoint is not published in the available sources, teams should cast a wider net across application upload routes and web roots used by HUMANIST Digital Human Resources.
Start by reviewing web server and application logs for multipart form submissions followed by requests to uncommon script files in upload directories. If your environment permits executable scripts under upload paths, look for accesses to .php, .jsp, .jspx, .asp, .aspx, .ashx, .cgi, or similarly dangerous extensions. Also investigate short bursts where a file is uploaded and then immediately requested by the same source IP or session.
A second useful control is filesystem monitoring. New files with server-executable extensions under application content directories are a strong signal, especially if they appear outside the normal deployment workflow. If your EDR supports command-line telemetry for web server worker processes, look for child processes spawned by the web service account after upload activity, since that can indicate shell execution.
Technical Notes
Example web log patterns to review:
POST /<upload-endpoint> HTTP/1.1
Content-Type: multipart/form-data; boundary=---------------------------
GET /uploads/shell.php HTTP/1.1
GET /files/temp/cmd.jsp?cmd=whoami HTTP/1.1
GET /content/2026/08/test.aspx HTTP/1.1
Simple grep-style triage on Linux web servers:
grep -RniE 'multipart/form-data|\.php|\.jsp|\.jspx|\.asp|\.aspx|\.ashx' /var/log/nginx /var/log/httpd /var/log/apache2 2>/dev/null
find /var/www /srv/www /opt -type f \( -iname "*.php" -o -iname "*.jsp" -o -iname "*.jspx" -o -iname "*.asp" -o -iname "*.aspx" -o -iname "*.ashx" \) -printf '%TY-%Tm-%Td %TT %p\n' | sort
Example Splunk search for suspicious upload-then-execute behavior:
(index=web OR index=proxy)
(
("multipart/form-data" AND method=POST)
OR uri_path="*.php"
OR uri_path="*.jsp"
OR uri_path="*.jspx"
OR uri_path="*.asp"
OR uri_path="*.aspx"
OR uri_path="*.ashx"
)
| stats count min(_time) as firstSeen max(_time) as lastSeen by src_ip, http_host, uri_path, method, status
| sort - lastSeen
If you lack product-specific log fields, monitor for any upload-capable route followed within minutes by a request to a newly created server-side script. That pattern is generic but highly relevant for this vulnerability class.
Mitigation and Patching
The confirmed fixed version in the NVD wording is 26.1. If you are running HUMANIST Digital Human Resources 26.0, upgrade to 26.1 as the primary remediation step. Because the available sources do not provide a vendor-authored upgrade procedure, organizations should follow their normal change-management process and validated application upgrade workflow for this product.
Before upgrading, capture backups of the application and its content directories, and preserve logs for incident review. After upgrading, verify not only the application version but also that no malicious files were left behind before the patch. A patch closes the vulnerable path; it does not remove an already-uploaded shell. Post-upgrade file integrity checks are therefore essential.
If immediate patching is not possible, apply compensating controls. Restrict public access to the application, especially any upload functionality, using VPN, IP allowlists, reverse-proxy ACLs, or temporary maintenance controls. Review whether the web server can execute scripts in upload directories; if so, disable execution there. Also consider WAF rules that block uploads of dangerous script extensions and suspicious multipart requests, although these controls should be treated as temporary risk reduction rather than complete fixes.
Because authentication requirements are unknown, assume that any exposed upload feature could be reachable by a broader audience than intended. If the application sits behind SSO or a portal, validate that only necessary roles retain access during the mitigation window.
Technical Notes
Example temporary hardening steps for common web server patterns.
Disable PHP execution in an uploads directory on Apache:
<Directory "/var/www/html/uploads">
php_admin_flag engine off
Options -ExecCGI
AllowOverride None
Require all granted
</Directory>
Disable script execution in an uploads location on NGINX by preventing script handling under that path:
location /uploads/ {
autoindex off;
types { }
default_type application/octet-stream;
location ~* \.(php|jsp|jspx|asp|aspx|ashx|cgi)$ { deny all; }
}
Generic Linux upgrade workflow placeholder, only if your internal packaging or vendor process uses staged artifacts. Use your vendor-approved method rather than guessing package names:
# Example operational sequence only
cp -a /opt/humanist /opt/humanist.backup.$(date +%F)
systemctl stop humanist
# apply vendor-supplied 26.1 update package here
systemctl start humanist
Post-patch triage for unexpected executable files:
find /var/www /srv/www /opt/humanist -type f \
\( -iname "*.php" -o -iname "*.jsp" -o -iname "*.jspx" -o -iname "*.asp" -o -iname "*.aspx" -o -iname "*.ashx" \) \
! -path "*/known-good/*" -ls
If your environment uses Windows IIS, review handler mappings and ensure upload directories do not permit script execution. If you do not know where HUMANIST stores uploads, identify writable application paths first and inspect them manually.
References
The primary reference for this CVE is the NVD record, which provides the confirmed product name, affected range, severity, and impact language. That is the strongest publicly accessible source available in the supplied research material and should be your baseline for change records and ticketing.
The second relevant source is the advisory URL referenced by NVD. In the research workflow supplied here, the advisory content was not fully retrievable beyond a generic HTML shell, so this article does not claim details that could not be verified directly. That is why fields such as the exact upload endpoint, privileges required, and public PoC status remain marked as unknown or unconfirmed.
- NVD CVE record: NVD CVE-2026-14175
- NVD reference advisory URL: Advisory
- CISA Known Exploited Vulnerabilities catalog: CISA KEV
In short, the defensible facts are these: CVE-2026-14175 is a critical unrestricted file upload vulnerability in HUMANIST Digital Human Resources, it affects versions 26.0 before 26.1, it can allow web-shell upload to the web server, and 26.1 is the fixed version indicated by the NVD wording. That is enough to justify immediate remediation and focused detection efforts.
For further reading on related vulnerabilities, check out our articles on CVE-2026-34037 and CVE-2026-44327.
This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.