NotrinosERP versions up to 1.0.0 contain a vulnerability in the HR module's employee document upload functionality. Authenticated users with the SA_EMPLOYEE permission can upload files with arbitrary extensions, including .php, which are stored under the web root without extension or MIME type validation. The upload handler uses the client-supplied filename verbatim, enabling remote code execution by accessing the uploaded PHP file. The application does not sanitize or restrict file extensions, nor does it prevent path traversal via crafted filenames. The uploaded file's path is displayed unescaped in the UI, exposing the exact URL for exploitation. The vulnerability requires authentication and a valid CSRF token but no file content checks are performed.

Successful exploitation allows any authenticated user with the SA_EMPLOYEE permission to execute arbitrary PHP code on the server hosting NotrinosERP, resulting in full remote code execution. This compromises the confidentiality, integrity, and availability of the server and potentially the entire application environment. The vulnerability also introduces a stored cross-site scripting (XSS) vector due to unescaped output of the file path. The attack surface is limited to authenticated users with specific HR permissions, but these permissions may be delegated or assigned to non-administrators depending on deployment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict the assignment of the SA_EMPLOYEE permission to trusted users only. As a temporary mitigation, implement server-side controls to block execution of uploaded files in the documents directory, such as web server configuration to deny execution of .php files in the upload path. Additionally, consider applying input validation to restrict allowed file extensions and sanitize filenames. Monitor vendor channels for an official patch or update addressing this issue.