This vulnerability (CVE-2026-14175) is classified as CWE-434, indicating an unrestricted upload of files with dangerous types in HUMANIST Digital Human Resources by Bilin Software and Informatics Consultancy Inc. The issue allows unauthenticated attackers to upload malicious files, such as web shells, to the web server, potentially enabling remote code execution or full system compromise. The affected version is 26.0, with the vulnerability present before version 26.1. The CVSS 3.1 base score is 9.8 (critical), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available.

Successful exploitation of this vulnerability can lead to complete compromise of the affected system, including unauthorized remote code execution via uploaded web shells. This results in full loss of confidentiality, integrity, and availability of the HUMANIST Digital Human Resources application and potentially the underlying server environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict or monitor file upload functionality, implement web application firewalls with file upload restrictions, and apply network-level protections to limit exposure. Avoid exposing the vulnerable version 26.0 to untrusted networks where possible.