# CVE-2026-42878: FacturaScripts information disclosure in Installer controller

Source: https://junglewise.ai/threats/cve-2026-42878-facturascripts-information-disclosure-in-installer-controller  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-27. Updated: 2026-06-09  
License: CC BY 4.0 with a link back

CVE-2026-42878 · Severity: medium · CVSS 5.3 · Published 2026-05-27

FacturaScripts, an open-source enterprise resource planning (ERP) and accounting system, contains a vulnerability that allows anyone to view sensitive server configuration details. By accessing a specific web address on a new installation, an attacker can see private information such as database passwords, API keys, and internal file paths. This information could be used to gain further access to the company's data or disrupt business operations.

Technologies: [NeoRazorX FacturaScripts](https://junglewise.ai/threats/technologies/facturascripts), [facturascripts/facturascripts (Packagist)](https://junglewise.ai/threats/technologies/facturascripts-facturascripts). Vendors: [NeoRazorX](https://junglewise.ai/threats/vendors/neorazorx), [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-42878 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-42878 being exploited in the wild.

**How severe is CVE-2026-42878?** Medium severity, with a CVSS score of 5.3, published 27 May 2026.

**Which products and versions are affected?** NeoRazorX FacturaScripts >= 2026, <= 2026.1, Prior to v2026; facturascripts/facturascripts (Packagist) ECOSYSTEM:introduced=2026,last_affected=2026.1.

**Is there a fix for CVE-2026-42878?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-42878 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-42878?** Check whether you run NeoRazorX FacturaScripts or facturascripts/facturascripts (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An unauthenticated information disclosure vulnerability exists in the Installer controller of FacturaScripts. The application contains a debug feature in `Core/Controller/Installer.php` that triggers the `phpinfo()` function when the `phpinfo` query parameter is set to `TRUE`. This can be exploited by a remote attacker on fresh deployments where the installation is not yet complete. Successful exploitation reveals sensitive data including server environment variables (which may contain DB_PASSWORD or AWS keys), filesystem paths, and exact PHP version details, facilitating further targeted attacks. The vulnerability was introduced in 2018 and persists in version 2026.1.

## Affected products

- NeoRazorX FacturaScripts >= 2026, <= 2026.1

## Identifiers

- CVE-2026-42878
- GHSA-vrxf-vrc4-22p7

## Timeline

- 2018-02-27: other: Vulnerability introduced in commit 8c31c106
- 2026-05-07: advisory: GitHub Advisory GHSA-vrxf-vrc4-22p7 published
- 2026-05-27: other: CVE-2026-42878 published to NVD

## References

- [https://api.github.com/users/preritpathak](https://api.github.com/users/preritpathak)
- [https://github.com/preritpathak](https://github.com/preritpathak)
- [https://api.github.com/users/preritpathak/gists%7B/gist_id%7D](https://api.github.com/users/preritpathak/gists%7B/gist_id%7D)
- [https://api.github.com/users/preritpathak/repos](https://api.github.com/users/preritpathak/repos)
- [https://avatars.githubusercontent.com/u/29928261?v=4](https://avatars.githubusercontent.com/u/29928261?v=4)
- [https://api.github.com/users/preritpathak/events%7B/privacy%7D](https://api.github.com/users/preritpathak/events%7B/privacy%7D)

## Related threats

- [FacturaScripts PHP object injection in WidgetSelect](https://junglewise.ai/threats/cve-2026-104905-facturascripts-before-version-2026-7-contains-a-php-object)
- [FacturaScripts path traversal and RCE in UploadedFile move](https://junglewise.ai/threats/facturascripts-path-traversal-and-rce-in-uploadedfile-move-40e5093b)
- [FacturaScripts stored XSS in WidgetVariante and WidgetSubcuenta](https://junglewise.ai/threats/cve-2026-45710-facturascripts-stored-xss-in-widgetvariante-and-widgetsubcuenta)
- [FacturaScripts CSV formula injection in CSVExport](https://junglewise.ai/threats/cve-2026-45263-facturascripts-csv-formula-injection-in-csvexport)
- [FacturaScripts path traversal in static file controllers](https://junglewise.ai/threats/cve-2026-45693-facturascripts-path-traversal-in-static-file-controllers)