Answer Brief
TWCERT/CC published a vulnerability note for an arbitrary file upload issue in Digiwin (育碁數位科技) a+HCM affecting versions up to and including 8.1. The note states an unauthenticated remote attacker could upload arbitrary files to arbitrary paths, including HTML files that could produce XSS-like effects. TWCERT/CC rates the issue CVSS 6.1 (Medium) and points users to the vendor’s security notice and patches.
Executive Summary: TWCERT/CC published a vulnerability note for an arbitrary file upload issue in Digiwin (育碁數位科技) a+HCM affecting versions up to and including 8.1. The note states an unauthenticated remote attacker could upload arbitrary files to arbitrary paths, including HTML files that could produce XSS-like effects. TWCERT/CC rates the issue CVSS 6.1 (Medium) and points users to the vendor’s security notice and patches.
Why It Matters
This TWCERT/CC advisory is a practical signal for identity and infrastructure risk teams because HCM platforms typically sit on trusted internal networks and handle HR workflows and employee data, making them high-value targets for initial access and lateral movement. According to the note, the vulnerability does not require authentication and allows uploading arbitrary files to arbitrary paths—conditions that can enable follow-on outcomes such as planting web-accessible content or manipulating server-side content, depending on deployment. TWCERT/CC also notes that attackers may upload HTML files to achieve an “XSS-like” effect, which matters operationally because it can translate into credential theft, session abuse, or workflow manipulation if users are induced to interact with uploaded content.
For global security teams, this is also a reminder that regionally prevalent enterprise applications can become overlooked exposure points in multinational environments (e.g., Taiwan-based subsidiaries, shared service centers, or vendor-hosted HR systems). The advisory’s remediation guidance is vendor-directed: upgrade and apply the latest corresponding patch updates referenced by Digiwin’s security announcement, or contact the vendor’s support channel. TWCERT/CC does not provide exploitation evidence or in-the-wild activity in this note, so risk should be assessed based on internet exposure, file upload endpoints, and business criticality rather than assuming active exploitation.
Event Type: security
Importance: medium
Affected Companies
- Digiwin (育碁數位科技)
- TWCERT/CC
- a+HCM
Affected Sectors
- Cybersecurity
- Enterprise software
- Human Capital Management (HCM)
Key Numbers
- TVN ID: TVN-202604005
- CVE: CVE-2026-6835
- CVSS: 6.1 (Medium)
- Affected versions: a+HCM 8.1 and earlier
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Public disclosure date: 2026-04-17
Timeline
- TWCERT/CC publishes TVN-202604005 for a+HCM arbitrary file upload (CVE-2026-6835).