This vulnerability (CVE-2026-14175) in HUMANIST Digital Human Resources allows an unauthenticated attacker to upload files of dangerous types, such as web shells, to the web server. This is due to insufficient validation or restriction on file upload types. The affected versions are from 26.0 before 26.1. The vulnerability is classified under CWE-434 (Unrestricted Upload of File with Dangerous Type). The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows remote attackers to upload malicious files (e.g., web shells) to the server, potentially leading to full system compromise, data theft, or service disruption. The vulnerability does not require authentication or user interaction, increasing its severity and exploitability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are currently provided. Until a patch is available, restrict file upload functionality, implement strict file type validation, and monitor for suspicious uploads as temporary mitigations.