PT-2026-21256 · Unknown · Opensourcepos

Hungnqdz · Published 2026-02-20 · Updated 2026-02-23 · CVE-2026-26746

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenSourcePOS version 3.4.1

Description The application contains a Local File Inclusion (LFI) issue within the Sales.php::getInvoice() function. An attacker can potentially read arbitrary files on the web server by manipulating the Invoice Type configuration. This issue may be combined with the file upload functionality to achieve Remote Code Execution (RCE).

Recommendations Apply updates to address the issue in the Sales.php::getInvoice() function.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2026-26746

Affected Products

Opensourcepos

References · 5

• 🔥 https://github.com/hungnqdz/CVE-2026-26746/blob/main/CVE-2026-26746.md · Exploit
• https://osv.dev/vulnerability/CVE-2026-26746 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-26746 · Security Note
• https://github.com/opensourcepos/opensourcepos · Note
• https://twitter.com/CVEnew/status/2025809091646652815 · Twitter Post