Executive brief
FacturaScripts, an open-source enterprise resource planning (ERP) and accounting system, contains a vulnerability that allows anyone to view sensitive server configuration details. By accessing a specific web address on a new installation, an attacker can see private information such as database passwords, API keys, and internal file paths. This information could be used to gain further access to the company's data or disrupt business operations.
Technical details
An unauthenticated information disclosure vulnerability exists in the Installer controller of FacturaScripts. The application contains a debug feature in `Core/Controller/Installer.php` that triggers the `phpinfo()` function when the `phpinfo` query parameter is set to `TRUE`. This can be exploited by a remote attacker on fresh deployments where the installation is not yet complete. Successful exploitation reveals sensitive data including server environment variables (which may contain DB_PASSWORD or AWS keys), filesystem paths, and exact PHP version details, facilitating further targeted attacks. The vulnerability was introduced in 2018 and persists in version 2026.1.
Affected products
- NeoRazorX FacturaScripts >= 2026, <= 2026.1
Timeline
- 2018-02-27: other: Vulnerability introduced in commit 8c31c106
- 2026-05-07: advisory: GitHub Advisory GHSA-vrxf-vrc4-22p7 published
- 2026-05-27: other: CVE-2026-42878 published to NVD