Is CVE-2026-42878 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-42878 being exploited in the wild.

How severe is CVE-2026-42878?

Medium severity, with a CVSS score of 5.3, published 27 May 2026.

Which products and versions are affected?

NeoRazorX FacturaScripts >= 2026, <= 2026.1, Prior to v2026; facturascripts/facturascripts (Packagist) ECOSYSTEM:introduced=2026,last_affected=2026.1.

Is there a fix for CVE-2026-42878?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-42878 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-42878?

Check whether you run NeoRazorX FacturaScripts or facturascripts/facturascripts (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-42878: FacturaScripts information disclosure in Installer controller

Q: Is there a fix for CVE-2026-42878?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-42878 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-42878?

Check whether you run NeoRazorX FacturaScripts or facturascripts/facturascripts (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-42878 · Severity: medium · CVSS 5.3 · Published 2026-05-27

FacturaScripts, an open-source enterprise resource planning (ERP) and accounting system, contains a vulnerability that allows anyone to view sensitive server configuration details. By accessing a specific web address on a new installation, an attacker can see private information such as database passwords, API keys, and internal file paths. This information could be used to gain further access to the company's data or disrupt business operations.

Technologies: NeoRazorX FacturaScripts, facturascripts/facturascripts (Packagist). Vendors: NeoRazorX, Packagist.

Quick answers

Is CVE-2026-42878 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-42878 being exploited in the wild.
How severe is CVE-2026-42878?: Medium severity, with a CVSS score of 5.3, published 27 May 2026.
Which products and versions are affected?: NeoRazorX FacturaScripts >= 2026, <= 2026.1, Prior to v2026; facturascripts/facturascripts (Packagist) ECOSYSTEM:introduced=2026,last_affected=2026.1.
Is there a fix for CVE-2026-42878?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-42878 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-42878?: Check whether you run NeoRazorX FacturaScripts or facturascripts/facturascripts (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An unauthenticated information disclosure vulnerability exists in the Installer controller of FacturaScripts. The application contains a debug feature in `Core/Controller/Installer.php` that triggers the `phpinfo()` function when the `phpinfo` query parameter is set to `TRUE`. This can be exploited by a remote attacker on fresh deployments where the installation is not yet complete. Successful exploitation reveals sensitive data including server environment variables (which may contain DB_PASSWORD or AWS keys), filesystem paths, and exact PHP version details, facilitating further targeted attacks. The vulnerability was introduced in 2018 and persists in version 2026.1.

Affected products

NeoRazorX FacturaScripts >= 2026, <= 2026.1

Identifiers

CVE-2026-42878
GHSA-vrxf-vrc4-22p7

Timeline

2018-02-27: other: Vulnerability introduced in commit 8c31c106
2026-05-07: advisory: GitHub Advisory GHSA-vrxf-vrc4-22p7 published
2026-05-27: other: CVE-2026-42878 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.