Information disclosure in FacturaScripts - CVE-2026-42878
Published: November 9, 2026
Vulnerability identifier: #VU163102
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-42878
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to retrieve sensitive PHP configuration and server environment information from FacturaScripts.
The vulnerability exists due to an unauthenticated phpinfo() diagnostic endpoint in the Installer controller that remains accessible before installation is completed, when config.php lacks db_name. An unauthenticated remote attacker can request /?phpinfo=TRUE to expose filesystem paths and environment variables, including credentials or application secrets if present.
Affected software
FacturaScripts
How to mitigate CVE-2026-42878
Install security update from vendor's website.
FacturaScripts - update to 2026.1