CVE-2026-6211: WEOLL File Upload ACL Bypass (CVSS 8.7)

Technical summary

CVE-2026-6211 is a CWE-434 (unrestricted upload of file with dangerous type) vulnerability in WEOLL versions 2.0.9 before 3.2.45.33. The upload mechanism fails to enforce both filename/type restrictions and proper access control list (ACL) validation, enabling an authenticated user to bypass authorization checks. The attack vector is network-accessible, requires low complexity, demands valid user credentials (PR:L), and necessitates user interaction (UI:R). The scope is changed, meaning exploitation can affect resources beyond the vulnerable component, with confirmed high confidentiality and integrity impact.

Business impact

An attacker with valid WEOLL credentials could upload executable, script, or malicious document files to access administrative functions, sensitive data repositories, or other system areas restricted by role. This could lead to unauthorized data disclosure, lateral movement within the platform, or system compromise if uploaded files are executed. Organizations relying on WEOLL for multi-tenant or role-based operations face elevated risk of privilege escalation and cross-tenant data exposure.

Affected systems

Global IT Informatics Services Inc. WEOLL versions 2.0.9 through 3.2.45.32 are affected. Any deployment of these versions in use requires remediation. Version 3.2.45.33 and later are patched; verify your current version against the vendor advisory to confirm if your installation is in the vulnerable range.

Exploitability

The vulnerability is exploitable by any user with valid WEOLL authentication. It does not require administrator privileges, lowering the barrier for malicious insiders or compromised accounts. The attack requires user interaction (likely file selection/submission), and the network-accessible attack surface means remote exploitation is possible from anywhere the WEOLL interface is exposed. Without evidence of active weaponized exploitation, this remains a high-severity but not yet publicly targeted vulnerability.

Remediation

Update WEOLL to version 3.2.45.33 or later. Global IT Informatics Services Inc. should have released patches addressing both unrestricted file upload and ACL enforcement. If immediate patching is not feasible, restrict upload functionality access via network segmentation or IAM policy until patches are applied. Audit recent file uploads and monitor for suspicious file types or access patterns in WEOLL audit logs.

Patch guidance

Upgrade to WEOLL 3.2.45.33 or later. Review the vendor advisory for any prerequisites, rollback procedures, or configuration changes required post-update. Verify the patch in a non-production environment first, especially if WEOLL is business-critical. Schedule the update during a maintenance window to avoid service interruption. After patching, confirm that file upload restrictions and ACL enforcement are functioning as expected through testing or vendor-supplied validation procedures.

Detection guidance

Monitor WEOLL audit and upload logs for attempts to upload files with unexpected or executable extensions (e.g., .exe, .sh, .jsp, .php, .aspx). Flag uploads by low-privileged users to directories or functionalities typically reserved for administrators. Watch for repeated failed uploads followed by successful ones—a sign of testing ACL weaknesses. Correlate upload events with subsequent unauthorized access attempts to sensitive features. Implement file integrity monitoring on WEOLL upload directories to detect post-exploitation file activity. Check for Web Application Firewall (WAF) signatures related to CWE-434 attacks if WEOLL is protected by a WAF.

Why prioritize this

This vulnerability merits urgent prioritization because it requires only valid credentials and user interaction to exploit, affects confidentiality and integrity across system scope boundaries, and is not yet in the CISA KEV catalog—meaning it remains less visible to defenders. The combination of low privilege requirement, high impact, and lack of current active exploitation coverage in defender tooling makes it a prime target for skilled attackers. Patching WEOLL in affected versions should be treated as a critical security initiative.

Risk score, explained

The CVSS 3.1 score of 8.7 (HIGH) reflects the network accessibility, low attack complexity, and dual impact on confidentiality and integrity. Although only low privilege and user interaction are required, the changed scope (affecting resources outside the component) and high impact ratings drive the severity. The absence of availability impact (denial of service) prevents a critical rating. Organizations running affected versions in internet-exposed or multi-user environments should treat this as equivalent to critical in their own risk models.

Frequently asked questions