Is CVE-2026-27891 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-27891 being exploited in the wild.

How severe is CVE-2026-27891?

High severity, with a CVSS score of 7.2, published 18 May 2026.

Which products and versions are affected?

NeoRazorX FacturaScripts <= 2026; facturascripts/facturascripts (Packagist) ECOSYSTEM:introduced=0,last_affected=2025.71.

Is there a fix for CVE-2026-27891?

A patch was published on 2026-05-18: Fix committed in version 2026.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-27891 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-27891?

Check whether you run NeoRazorX FacturaScripts or facturascripts/facturascripts (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-27891: FacturaScripts Zip Slip path traversal in plugin upload

Q: Is there a fix for CVE-2026-27891?

A patch was published on 2026-05-18: Fix committed in version 2026.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-27891 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-27891?

Check whether you run NeoRazorX FacturaScripts or facturascripts/facturascripts (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-27891 · Severity: high · CVSS 7.2 · Published 2026-05-18

FacturaScripts is an open-source accounting and invoicing platform used by businesses to manage financial records. A security flaw in the plugin installation system allows an administrative user to upload a specially crafted file that bypasses security checks. This can lead to the attacker taking full control of the web server, potentially resulting in the theft of financial data, service disruption, or complete system compromise.

Technologies: NeoRazorX FacturaScripts, facturascripts/facturascripts (Packagist). Vendors: NeoRazorX, Packagist.

Quick answers

Is CVE-2026-27891 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-27891 being exploited in the wild.
How severe is CVE-2026-27891?: High severity, with a CVSS score of 7.2, published 18 May 2026.
Which products and versions are affected?: NeoRazorX FacturaScripts <= 2026; facturascripts/facturascripts (Packagist) ECOSYSTEM:introduced=0,last_affected=2025.71.
Is there a fix for CVE-2026-27891?: A patch was published on 2026-05-18: Fix committed in version 2026.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-27891 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-27891?: Check whether you run NeoRazorX FacturaScripts or facturascripts/facturascripts (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Zip Slip vulnerability exists in the `Plugins::add()` function within `Plugins.php`. While the `testZipFile` function attempts to verify that an uploaded ZIP archive contains only one root folder, it fails to sanitize individual file paths within that archive. An attacker can bypass the root folder check by using a path like `ValidPluginName/../../shell.php`. During extraction, the `../` sequences trigger a path traversal, allowing the attacker to write arbitrary PHP files to the web root. This requires administrative privileges to access the plugin upload feature but results in full Remote Code Execution (RCE). The issue is addressed in version 2026.1 by rejecting ZIP entries containing directory traversal sequences.

Affected products

NeoRazorX FacturaScripts <= 2026

Identifiers

CVE-2026-27891
GHSA-3pgc-xqg9-cfr6

Timeline

2026-05-07: advisory: GitHub Security Advisory published
2026-05-18: disclosed: CVE published to NVD
2026-05-18: patched: Fix committed in version 2026.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.