The a+HCM application by aEnrich suffers from CWE-434, an unrestricted file upload vulnerability. This flaw permits unauthenticated attackers to upload arbitrary files to any location on the server, including potentially dangerous file types such as HTML. This can result in XSS-like impacts by enabling malicious content to be served from the application. The vulnerability is publicly documented with CVE-2026-6835 and has a CVSS 4.0 score of 5.1, indicating medium severity. No patch or official remediation level has been disclosed by the vendor, and the product is not a cloud service.

Successful exploitation allows unauthenticated remote attackers to upload arbitrary files to any path within the affected system. This can lead to the execution of malicious scripts or content, resulting in cross-site scripting (XSS)-like effects. The impact is rated medium severity based on the CVSS score of 5.1. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict or monitor file upload functionality and implement compensating controls such as input validation and file type restrictions where possible. Avoid exposing the vulnerable upload interface to untrusted users.