PT-2026-21256 · Unknown · Opensourcepos

Hungnqdz · Publicado 2026-02-20 · Atualizado 2026-02-23 · CVE-2026-26746

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenSourcePOS version 3.4.1

Description The application contains a Local File Inclusion (LFI) issue within the Sales.php::getInvoice() function. An attacker can potentially read arbitrary files on the web server by manipulating the Invoice Type configuration. This issue may be combined with the file upload functionality to achieve Remote Code Execution (RCE).

Recommendations Apply updates to address the issue in the Sales.php::getInvoice() function.

Exploit

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2026-26746

Produtos afetados

Opensourcepos

Referências · 5

• 🔥 https://github.com/hungnqdz/CVE-2026-26746/blob/main/CVE-2026-26746.md · Exploit
• https://github.com/opensourcepos/opensourcepos · Nota
• https://twitter.com/CVEnew/status/2025809091646652815 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-26746 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-26746 · Nota de Segurança