SB20261109202 - Multiple vulnerabilities in FacturaScripts

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261109202

SB20261109202 - Multiple vulnerabilities in FacturaScripts

Published: November 9, 2026

Security Bulletin ID SB20261109202
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 5
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 60% Low 40%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 5 vulnerabilities.


1) Path traversal (CVE-ID: CVE-2026-45693)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to read private invoices and other protected documents within a FacturaScripts installation.

The vulnerability exists due to URL prefix checks in static file controllers that authorize requests without validating the canonical filesystem path when traversal segments are present. An unauthenticated remote attacker can send a crafted request beginning with /Plugins/ and containing ../ to retrieve private files with allowed extensions without an access token.


2) Cross-site scripting (CVE-ID: CVE-2026-45710)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a highly privileged authenticated attacker to execute stored JavaScript in another user's FacturaScripts session.

The vulnerability exists due to HTML-escaped quotes being decoded inside JavaScript event handlers in WidgetVariante and WidgetSubcuenta picker rows. A highly privileged authenticated attacker can plant malicious variant references or subaccount codes through authorized editing or database writes and execute scripts when a victim clicks a poisoned picker row, with variant exploitation requiring a plugin form using default reference matching.


3) SQL injection (CVE-ID: CVE-2026-45262)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a low-privileged remote attacker to retrieve sensitive database contents and take over an administrator account in FacturaScripts.

The vulnerability exists due to missing validation of REST API filter keys and an identifier-escaping bypass for keys containing parentheses. A low-privileged remote attacker with a read-only API key for one resource can submit crafted filters when API access is enabled, exposing administrator password hashes and reusable session tokens.


4) Improper Neutralization of Formula Elements in a CSV File (CVE-ID: CVE-2026-45263)

CWE-ID: CWE-1236 - Improper Neutralization of Formula Elements in a CSV File

CVSSv4: 8.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows an authenticated low-privilege attacker to execute arbitrary commands on an administrator's workstation through a malicious CSV export.

The vulnerability exists due to missing formula neutralization in FacturaScripts' CSVExport component when exporting user-controlled text fields. An authenticated low-privilege attacker can use insert or update permissions to plant a formula that executes when an administrator exports the affected records, opens the CSV in a spreadsheet application, and approves any required DDE prompt.


5) Cross-site scripting (CVE-ID: CVE-2026-77529)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows an administrator to execute stored JavaScript in another administrator's session when the victim views sent email in FacturaScripts.

The vulnerability exists due to incomplete client-side HTML sanitization in the EmailSentHtml viewer when rendering stored email bodies. An administrator can plant malicious HTML through notification templates or SendMail access, causing script execution with access to the victim's session data and CSRF tokens when the victim opens the email HTML tab.


Remediation

Install update from vendor's website.

References