SB20261109199 - Multiple vulnerabilities in FacturaScripts

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261109199

SB20261109199 - Multiple vulnerabilities in FacturaScripts

Published: November 9, 2026

Security Bulletin ID SB20261109199
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 4
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 50% Low 50%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 4 vulnerabilities.


1) Information disclosure (CVE-ID: CVE-2026-42878)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to retrieve sensitive PHP configuration and server environment information from FacturaScripts.

The vulnerability exists due to an unauthenticated phpinfo() diagnostic endpoint in the Installer controller that remains accessible before installation is completed, when config.php lacks db_name. An unauthenticated remote attacker can request /?phpinfo=TRUE to expose filesystem paths and environment variables, including credentials or application secrets if present.


2) Arbitrary file upload (CVE-ID: CVE-2026-42879)

CWE-ID: CWE-434 - Unrestricted Upload of File with Dangerous Type

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows an authenticated remote attacker to upload executable PHP files through FacturaScripts' product image upload functionality.

The vulnerability exists due to MIME validation that accepts PHP files prefixed with a GIF header while preserving executable extensions in a web-accessible upload directory. An authenticated remote attacker can submit a disguised PHP file and request its stored URL to execute commands when the server is configured to execute PHP in that directory.


3) Cross-site scripting (CVE-ID: CVE-2026-42877)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows an authenticated attacker to execute arbitrary JavaScript in another user's authenticated browser session.

The vulnerability exists due to insufficient JavaScript-context escaping of product references in FacturaScripts sales and purchases product search modals when a user clicks a crafted product. An authenticated attacker with warehouse product write access can store a malicious reference and cause an administrator who selects that product to perform unauthorized actions.


4) Information disclosure (CVE-ID: N/A)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a low-privileged remote attacker with an API key granting read access to users to take over any FacturaScripts account, including administrator accounts.

The vulnerability exists due to the REST API returning sensitive user fields, including session tokens, when processing authorized read requests. A low-privileged remote attacker can retrieve these tokens and construct session cookies to authenticate as another user without knowing their password or requiring victim interaction.


Remediation

Install update from vendor's website.

References