Executive brief
FacturaScripts: Path traversal in UploadedFile::move() via getClientOriginalName() — arbitrary file write outside MyFiles/ leading to RCE
Affected products
- Packagist facturascripts/facturascripts
Junglewise Threat Intelligence
FacturaScripts: Path traversal in UploadedFile::move() via getClientOriginalName() , arbitrary file write outside MyFiles/ leading to RCE
Severity: low · CVSS 3.1 · Published 2026-07-14
Technologies: facturascripts/facturascripts (Packagist). Vendors: Packagist.