CVE-2026-84147: CWE-434 Unrestricted upload of file with dangerous type in Manacle Technologies Multi-tenant ERP System

This vulnerability (CWE-434) in the Manacle Technologies Multi-tenant ERP System allows unauthenticated remote attackers to upload files of dangerous types due to inadequate authentication and file type validation at an API endpoint. Uploaded files can be placed in web-accessible directories, enabling attackers to execute arbitrary code on the targeted system. The CVSS 4.0 vector indicates network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, availability, and security requirements. No known exploits in the wild or vendor patches are currently reported.

An attacker exploiting this vulnerability can execute arbitrary code remotely without authentication, potentially leading to full compromise of the affected ERP system. This could result in unauthorized access, data theft, system disruption, or further lateral movement within the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable API endpoint, implement network-level controls to limit exposure, and monitor for suspicious file uploads or web directory changes.