PT-2026-53268 · Frontaccounting · Frontaccounting

Jiva · Publicado 2026-06-29 · Atualizado 2026-06-29 · CVE-2026-40521

NVD

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

FrontAccounting before 2.4.20 contains a path traversal vulnerability in the attachment upload handler that allows authenticated attackers to execute arbitrary code by uploading files with traversal sequences in the unique name parameter. Attackers can supply path traversal sequences ../../../shell.php to write files outside the intended attachments directory into the web root, and by uploading PHP files without extension validation, achieve remote code execution as the web server user.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2026-40521

Produtos afetados

Frontaccounting

Referências · 5

• 🔥 https://jivasecurity.com/writeups/frontaccounting-rce-attachment-upload-cve-2026-40521 · Exploit
• https://github.com/FrontAccountingERP/FA/commit/701fea6848da4a02fb83d30f07a9c0473d6b7e33 · Correção
• https://vulncheck.com/advisories/frontaccounting-path-traversal-rce-via-attachment-upload · Nota
• https://sourceforge.net/p/frontaccounting/news/2026/04/release-2420 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-40521 · Nota de Segurança