---
id: "CVE-2026-112190"
kind: "vulnerability"
aliases: ["CVE-2026-112190"]
title: "Webkul Aureus ERP: composer.json processing leaks sensitive data into debug output"
severity: "medium"
cvss: 5.5
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["erp", "other", "php", "self-hosted"]
not_affected_if: []
published_at: "2026-10-19T17:17:14+00:00"
first_seen_at: "2026-10-23T21:57:18+00:00"
updated_at: "2026-10-25T04:12:47+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112190", "first_seen_at": "2026-10-23T21:57:18+00:00"}]
---

# Webkul Aureus ERP: composer.json processing leaks sensitive data into debug output

Webkul Aureus ERP up to 1.6.0 mishandles the composer.json file, which inserts sensitive information into debugging code. A remote attacker can read that leaked data, though the sources do not say exactly what data is exposed.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-10-23T21:57:18+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112190

## From the sources

A security vulnerability has been detected in Webkul Aureus ERP up to 1.6.0. This issue affects some unknown processing of the file composer.json. Such manipulation leads to insertion of sensitive information into debugging code. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_