Path traversal in FacturaScripts - #VU163133
Published: November 9, 2026
Vulnerability identifier: #VU163133
CSH Severity: Low
CVSS v4: 7.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an authenticated remote attacker to disclose sensitive files, including database credentials, and remove their originals.
The vulnerability exists due to unchecked path traversal in FacturaScripts' AttachedFile rename source through the API's mass-assigned path field. An authenticated remote attacker with an API key permitting POST on attachedfiles can submit a traversal path without uploading a file, moving files into downloadable storage when source-directory permissions and same-filesystem constraints permit.
Affected software
FacturaScripts
Remediation
Install security update from vendor's website.
FacturaScripts - update to 2026.7