CVE-2026-6211: Arbitrary File Upload in Global IT's WEOLL

Synopsis

An arbitrary file upload vulnerability exists in Global IT Informatics Services Inc. WEOLL, affecting versions from 2.0.9 up to (but not including) 3.2.45.33. The vulnerability is reachable over the network and requires a low-privilege authenticated account plus a victim interaction step; it bypasses access controls by allowing upload of dangerous file types, which gives an attacker the ability to read sensitive data and tamper with application content across scopes beyond the originating user context. A patched-image rebuild at version 3.2.45.33 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the WEOLL service over the network; the vulnerability is exposed via a standard network-accessible endpoint.

• AuthenticationRequired

  Any low-privilege authenticated account is sufficient; no administrative credentials are needed to exploit the file upload endpoint.

• Victim interactionRequired

  A victim user must take an action (such as loading or accessing content delivered through the uploaded file) for the exploit to complete its intended effect.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other variable environmental factors.

Blast Radius

• An attacker can upload server-executable files (such as web shells or scripts) that run in the application context, bypassing access control restrictions.
• Confidentiality impact is high: the attacker gains the ability to read stored application data, session tokens, and other sensitive records accessible to the WEOLL process.
• Integrity impact is high: the attacker can modify persisted application files, overwrite existing content, or introduce malicious payloads into the application file system.
• Because the scope token is Changed (S:C), impact can extend beyond the vulnerable WEOLL component to other resources or services on the same host or platform.