Path traversal in FacturaScripts - #VU163122
Published: November 9, 2026
Vulnerability identifier: #VU163122
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote authenticated attacker with low privileges to read sensitive files accessible to the web server.
The vulnerability exists due to unchecked directory traversal in FacturaScripts SendMail attachment filenames when email sending is configured. A remote authenticated attacker with low privileges and access to the SendMail page can submit a crafted filename to email themselves files such as config.php, exposing database credentials.
Affected software
FacturaScripts
Remediation
Install security update from vendor's website.
FacturaScripts - update to 2026.7