PT-2026-38610 · Unknown · Facturascripts

Published 2026-05-07 · Updated 2026-05-19 · CVE-2026-27891

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FacturaScripts versions prior to 2026.1

Description A Zip Slip issue exists in the Plugins::add() function within Plugins.php. The system does not properly validate or sanitize file paths inside uploaded ZIP archives. Although the testZipFile() function checks if the ZIP contains only one root folder, it fails to validate individual file paths. An attacker can bypass this check by using path traversal sequences, such as ../../, in filenames. This allows for Arbitrary File Write and Remote Code Execution (RCE) by overwriting sensitive .php files outside the intended plugins directory, wherever the web server has write permissions.

Recommendations Update to version 2026.1. As a temporary workaround, restrict access to the plugin upload functionality or the Plugins::add() function until the update is applied.

Exploit

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-20

CWE-434

Related Identifiers

CVE-2026-27891

GHSA-3PGC-XQG9-CFR6

Affected Products

Facturascripts

References · 10

• 🔥 https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-3pgc-xqg9-cfr6 · Exploit
• https://osv.dev/vulnerability/GHSA-3pgc-xqg9-cfr6 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27891 · Security Note
• https://github.com/NeoRazorX/facturascripts/commit/2dda7c6f3b241fa84a0629166783720b882725fd · Note
• https://github.com/NeoRazorX/facturascripts · Note
• https://twitter.com/CVEnew/status/2056670120756560318 · Twitter Post
• https://t.me/cveNotify/163936 · Telegram Post
• https://twitter.com/infoflowcloud/status/2056671559385776134 · Twitter Post
• https://t.me/CVEtracker/54176 · Telegram Post
• https://twitter.com/dailycve/status/2052476075721048089 · Twitter Post