Path traversal in FacturaScripts - CVE-2026-45693
Published: November 9, 2026
Vulnerability identifier: #VU163110
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-45693
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to read private invoices and other protected documents within a FacturaScripts installation.
The vulnerability exists due to URL prefix checks in static file controllers that authorize requests without validating the canonical filesystem path when traversal segments are present. An unauthenticated remote attacker can send a crafted request beginning with /Plugins/ and containing ../ to retrieve private files with allowed extensions without an access token.
Affected software
FacturaScripts
How to mitigate CVE-2026-45693
Install security update from vendor's website.
FacturaScripts - update to 2026.2