SB20261109201 - Multiple vulnerabilities in FacturaScripts

Description

This security bulletin contains information about 2 vulnerabilities.

1) Improper Authentication (CVE-ID: CVE-2026-47677)

CWE-ID: CWE-287 - Improper Authentication

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows an unauthenticated network attacker to take over any two-factor-enabled FacturaScripts account whose username is known.

The vulnerability exists due to the login controller accepting two-factor validation requests without prior password verification or rate limiting. An unauthenticated network attacker can repeatedly submit guessed six-digit codes to /login and obtain a fully authenticated session with the victim's access privileges when a code matches.

2) Path traversal (CVE-ID: CVE-2026-77526)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an authenticated attacker to write arbitrary files outside MyFiles/ in FacturaScripts.

The vulnerability exists due to missing path normalization in UploadedFile::move() when processing uploaded filenames containing traversal segments. An authenticated attacker can use upload permissions to place files in web-server-writable directories and execute code as the web-server user on Apache deployments that directly serve those directories and permit uploaded .htaccess overrides.

Remediation

Install update from vendor's website.

References

• https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-c67f-gmxw-mj93
• https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-hgjx-r89m-m7v4