SB20261109204 - Multiple vulnerabilities in FacturaScripts

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261109204

SB20261109204 - Multiple vulnerabilities in FacturaScripts

Published: November 9, 2026 Updated: November 10, 2026

Security Bulletin ID SB20261109204
CSH Severity
High
Patch available
YES
Number of vulnerabilities 17
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 6% Medium 41% Low 53%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 17 vulnerabilities.


1) Cross-site request forgery (CVE-ID: N/A)

CWE-ID: CWE-352 - Cross-Site Request Forgery (CSRF)

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated attacker to force code redeployment and unauthorized configuration changes in FacturaScripts.

The vulnerability exists due to missing anti-CSRF token validation in the Wizard controller's step3 action, which accepts state-changing GET requests. An unauthenticated attacker can lure a logged-in administrator with Wizard access into following a cross-site link, triggering redeployment and overwriting the global default role and the victim's homepage setting under the administrator's session.


2) Path traversal (CVE-ID: N/A)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 7.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows an authenticated remote attacker to disclose sensitive files, including database credentials, and remove their originals.

The vulnerability exists due to unchecked path traversal in FacturaScripts' AttachedFile rename source through the API's mass-assigned path field. An authenticated remote attacker with an API key permitting POST on attachedfiles can submit a traversal path without uploading a file, moving files into downloadable storage when source-directory permissions and same-filesystem constraints permit.


3) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a low-privileged authenticated attacker to mass-reassign product, customer, and tariff associations in FacturaScripts despite having view-only permissions.

The vulnerability exists due to missing update-permission checks in association handlers when processing authenticated same-site POST requests. A low-privileged authenticated attacker can submit association changes from their own session to pages they may access, modifying records without permission to update them.


4) Authorization bypass through user-controlled key (CVE-ID: N/A)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an authenticated remote attacker with update permission on any DocFilesTrait controller to delete or reorder attachment relations belonging to other users throughout FacturaScripts.

The vulnerability exists due to missing record binding in DocFilesTrait attachment actions when processing user-supplied relation identifiers. An authenticated remote attacker can submit another record's relation identifier through an authorized controller to tamper with attachment associations without permission to modify the target record.


5) Cross-site request forgery (CVE-ID: N/A)

CWE-ID: CWE-352 - Cross-Site Request Forgery (CSRF)

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to force customer or supplier master-record creation and contact modification in FacturaScripts.

The vulnerability exists due to missing CSRF token validation in EditContacto conversion actions reachable through GET requests. An unauthenticated remote attacker can lure an authenticated user with EditContacto and customer or supplier update permissions into a top-level navigation that carries authentication cookies under SameSite=Lax and silently performs the conversion.


6) SQL injection (CVE-ID: N/A)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a low-privileged attacker to read arbitrary database tables beyond an API key's authorized scope, exposing password hashes and secrets.

The vulnerability exists due to missing validation of the operation query parameter used as an SQL filter connector in the FacturaScripts REST API. A low-privileged attacker can inject SQL to bypass query constraints using a scoped API key with read access when the normally disabled REST API is enabled.


7) Cross-site scripting (CVE-ID: N/A)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a low-privileged authenticated attacker to execute arbitrary JavaScript in another user's session, including an administrator's session.

The vulnerability exists due to incorrect JavaScript-context escaping of uploaded file names in the FacturaScripts file-library widget's inline click handler. A low-privileged authenticated attacker can upload a file with a crafted name using file-attachment permissions and trigger stored cross-site scripting when a victim clicks the affected file in the widget.


8) Improper Restriction of Excessive Authentication Attempts (CVE-ID: N/A)

CWE-ID: CWE-307 - Improper Restriction of Excessive Authentication Attempts

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to bypass IP-based rate limiting in FacturaScripts for cross-account password spraying and API brute force.

The vulnerability exists due to client IP resolution trusting attacker-controlled X-Forwarded-For or CF-Connecting-IP headers without validating a trusted proxy when processing authentication requests. An unauthenticated remote attacker can rotate forged IP headers between attempts to evade IP counters, while login attempts remain subject to per-username limits.


9) Cross-site request forgery (CVE-ID: N/A)

CWE-ID: CWE-352 - Cross-Site Request Forgery (CSRF)

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to permanently delete attacker-selected sales or purchase documents in FacturaScripts.

The vulnerability exists due to missing anti-CSRF token validation in the AjaxForms sales and purchase controllers when processing GET requests for the delete-doc action. An unauthenticated remote attacker can lure an authenticated user with document deletion rights into following a crafted cross-site link, causing deletion of the selected document under the victim's session.


10) Deserialization of Untrusted Data (CVE-ID: CVE-2026-104905)

CWE-ID: CWE-502 - Deserialization of Untrusted Data

CVSSv4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows an authenticated attacker to delete arbitrary files writable by the web-server user in FacturaScripts.

The vulnerability exists due to unrestricted deserialization of submitted values in WidgetSelect when an accessible edit form contains an editable select field configured with multiple="true". An authenticated attacker can submit a serialized object as the field value and save the form to trigger deletion of attacker-selected files.


11) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a low-privileged authenticated attacker to alter accounting-entry reconciliation states in FacturaScripts despite having only view access.

The vulnerability exists due to a missing update-permission check in the EditSubcuenta controller's dot-accounting action, exploitable with a role configured for page access without update rights. A low-privileged authenticated attacker can submit a same-site POST request from their own session identifying arbitrary accounting entries to change their reconciliation flags.


12) Path traversal (CVE-ID: N/A)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote authenticated attacker with low privileges to read sensitive files accessible to the web server.

The vulnerability exists due to unchecked directory traversal in FacturaScripts SendMail attachment filenames when email sending is configured. A remote authenticated attacker with low privileges and access to the SendMail page can submit a crafted filename to email themselves files such as config.php, exposing database credentials.


13) Use of insufficiently random values (CVE-ID: N/A)

CWE-ID: CWE-330 - Use of Insufficiently Random Values

CVSSv4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to disable all FacturaScripts plugins and cause a complete ERP outage.

The vulnerability exists due to a predictable token derived from database credentials and the current hour that authorizes maintenance requests to the /Deploy controller without a session or API key. An unauthenticated remote attacker can compute the token using known or guessed database credentials and the application's timezone, then submit requests to disable plugins or trigger a rebuild.


14) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a low-privileged authenticated attacker to read arbitrary database columns and take over an administrator session in FacturaScripts.

The vulnerability exists due to missing table and column authorization in the framework's autocomplete, datalist, and select actions when processing query parameters. A low-privileged authenticated attacker can access one permitted list or edit page to retrieve an administrator's session credential and reuse it to gain administrative access without victim interaction.


15) Authorization bypass through user-controlled key (CVE-ID: N/A)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a low-privileged authenticated attacker to read other users' customer records and sent-email bodies in FacturaScripts.

The vulnerability exists due to missing enforcement of the onlyownerdata ownership restriction in edit-controller export and pre-load actions when requesting another user's record. A low-privileged authenticated attacker can supply another record's identifier to retrieve its email body or, with export permission, export its contents despite the normal page denying access.


16) Code injection (CVE-ID: N/A)

CWE-ID: CWE-96 - Improper Neutralization of Directives in Statically Saved Code (\'Static Code Injection\')

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to execute persistent arbitrary PHP code in the web server context on a FacturaScripts instance awaiting installation.

The vulnerability exists due to the web installer writing fs_cookie_expire and related plugin parameters directly into config.php without casting or escaping when no configuration file exists. An unauthenticated remote attacker can submit crafted installer parameters to inject PHP into that file, which executes on subsequent requests.


17) Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) (CVE-ID: N/A)

CWE-ID: CWE-338 - Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to attempt unauthorized access by predicting security tokens used to protect FacturaScripts accounts.

The vulnerability exists due to the use of PHP's cryptographically weak rand() generator in FacturaScripts' randomString() function when creating session tokens, API keys, and email verification codes. An unauthenticated remote attacker can attempt generator-state recovery to predict these tokens, but successful prediction was not demonstrated and is complicated by truncated output and multi-worker deployments.


Remediation

Install update from vendor's website.

References