Executive brief
FacturaScripts is an open-source accounting and invoicing platform used by businesses to manage financial records. A security flaw in the plugin installation system allows an administrative user to upload a specially crafted file that bypasses security checks. This can lead to the attacker taking full control of the web server, potentially resulting in the theft of financial data, service disruption, or complete system compromise.
Technical details
A Zip Slip vulnerability exists in the `Plugins::add()` function within `Plugins.php`. While the `testZipFile` function attempts to verify that an uploaded ZIP archive contains only one root folder, it fails to sanitize individual file paths within that archive. An attacker can bypass the root folder check by using a path like `ValidPluginName/../../shell.php`. During extraction, the `../` sequences trigger a path traversal, allowing the attacker to write arbitrary PHP files to the web root. This requires administrative privileges to access the plugin upload feature but results in full Remote Code Execution (RCE). The issue is addressed in version 2026.1 by rejecting ZIP entries containing directory traversal sequences.
Affected products
- NeoRazorX FacturaScripts <= 2026
Timeline
- 2026-05-07: advisory: GitHub Security Advisory published
- 2026-05-18: disclosed: CVE published to NVD
- 2026-05-18: patched: Fix committed in version 2026.1