CVE-2026-13547 Overview
CVE-2026-13547 is an unrestricted file upload vulnerability in Hanwang e-Face General Management Platform version 6.3.5.4. The flaw resides in the /manage/resourceUpload/upload.do endpoint, where manipulation of the File parameter permits arbitrary file uploads. Attackers can exploit the issue remotely without authentication or user interaction. The exploit has been publicly disclosed, increasing the likelihood of opportunistic attacks against exposed installations. The weakness is categorized under [CWE-284] Improper Access Control.
Critical Impact
Remote, unauthenticated attackers can upload arbitrary files to the platform, which may enable webshell deployment, data tampering, or lateral movement within the environment.
Affected Products
- Hanwang e-Face General Management Platform 6.3.5.4
- /manage/resourceUpload/upload.do endpoint
- Deployments exposing the upload interface to untrusted networks
Discovery Timeline
- 2026-06-29 - CVE-2026-13547 published to NVD
- 2026-06-29 - Last updated in NVD database
Technical Details for CVE-2026-13547
Vulnerability Analysis
The vulnerability affects the file upload handler at /manage/resourceUpload/upload.do in the Hanwang e-Face General Management Platform. The endpoint processes the File argument without enforcing sufficient restrictions on file type, extension, or content. This allows an attacker to submit crafted requests that place attacker-controlled files onto the server file system.
Because the endpoint is reachable over the network and requires no privileges or user interaction, attackers can automate exploitation against exposed instances. Once a file is uploaded, follow-on impact depends on where the file is written and whether it is served or executed by the application runtime. Public disclosure of the technique lowers the barrier for adversaries seeking to weaponize the issue.
Root Cause
The root cause is improper access control on the resource upload handler, tracked as [CWE-284]. The application does not adequately validate uploaded content, restrict file extensions, or authenticate the requester before writing files to disk. This design gap converts a routine upload feature into an initial-access primitive.
Attack Vector
Exploitation occurs over the network by sending a crafted multipart request to /manage/resourceUpload/upload.do with a malicious File parameter. No credentials are required. Successful upload of an executable resource, such as a server-side script, can lead to code execution in the web application context. Details of the technique are documented in the VulDB CVE-2026-13547 entry and the Feishu Wiki Resource.
Detection Methods for CVE-2026-13547
Indicators of Compromise
- HTTP POST requests to /manage/resourceUpload/upload.do originating from external or unexpected sources.
- Newly created files with executable extensions (.jsp, .jspx, .war, .aspx, .php) inside upload or web-accessible directories.
- Outbound connections from the Hanwang platform host to unfamiliar addresses following upload activity.
Detection Strategies
- Inspect web server access logs for POST requests to the vulnerable path with unusual Content-Type or filename values in the File parameter.
- Deploy web application firewall rules that block uploads containing script extensions or MIME types inconsistent with expected resource content.
- Correlate upload events with subsequent process creation on the host to identify webshell execution chains.
Monitoring Recommendations
- Baseline the volume and source geography of requests to /manage/resourceUpload/upload.do and alert on deviations.
- Enable file integrity monitoring on the platform's web root and upload directories.
- Capture and retain full HTTP request bodies for the upload endpoint to support forensic review.
How to Mitigate CVE-2026-13547
Immediate Actions Required
- Restrict network access to the Hanwang e-Face management interface to trusted administrative networks only.
- Disable or block the /manage/resourceUpload/upload.do endpoint at the reverse proxy or WAF until a vendor fix is applied.
- Audit upload directories for unexpected files and remove any unauthorized artifacts.
Patch Information
No vendor patch is referenced in the available advisory data. Administrators should monitor the VulDB CVE-2026-13547 entry and Hanwang vendor communications for remediation guidance. Consult the Feishu Wiki Resource for additional technical context.
Workarounds
- Enforce authentication and IP allow-listing in front of the management platform using a reverse proxy.
- Configure the web server to prevent execution of scripts within upload directories by removing handler mappings.
- Apply WAF signatures that reject requests to upload.do containing script content or dangerous file extensions in the File parameter.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
