Input validation error in FacturaScripts - CVE-2026-27891
Published: November 9, 2026
Vulnerability identifier: #VU163106
CSH Severity: Low
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-27891
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a highly privileged remote attacker to execute arbitrary code with the web server's privileges.
The vulnerability exists due to insufficient validation of ZIP entry paths in FacturaScripts' plugin upload mechanism, allowing extraction outside the designated plugins directory. A highly privileged remote attacker can upload a crafted plugin archive containing traversal paths to write a PHP shell to a web-accessible location and execute it through an HTTP request.
Affected software
FacturaScripts
How to mitigate CVE-2026-27891
Install security update from vendor's website.
FacturaScripts - update to 2026