Code injection in FacturaScripts - #VU163118
Published: November 9, 2026
Vulnerability identifier: #VU163118
CSH Severity: High
CVSS v4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-96
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to execute persistent arbitrary PHP code in the web server context on a FacturaScripts instance awaiting installation.
The vulnerability exists due to the web installer writing fs_cookie_expire and related plugin parameters directly into config.php without casting or escaping when no configuration file exists. An unauthenticated remote attacker can submit crafted installer parameters to inject PHP into that file, which executes on subsequent requests.
Affected software
FacturaScripts
Remediation
Install security update from vendor's website.
FacturaScripts - update to 2026.7