PT-2026-38616 · Neorazorx+1 · Facturascripts+1

Preritpathak · Published 2026-05-07 · Updated 2026-05-27 · CVE-2026-42878

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions FacturaScripts versions prior to v2026

Description An unauthenticated information disclosure issue in the Installer controller allows a remote attacker to trigger the phpinfo() function on a fresh deployment. By requesting the endpoint "/" with the parameter phpinfo set to "TRUE", an attacker can expose the full PHP configuration, server environment variables, filesystem paths, and loaded extensions. This exposure may include sensitive data such as database credentials, API keys, or application secrets stored as environment variables.

Recommendations Update to version v2026. As a temporary workaround, restrict access to the Installer controller or the "/" endpoint until the update is applied.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2026-42878

GHSA-VRXF-VRC4-22P7

Affected Products

Facturascripts

Facturascripts/Facturascripts

References · 6

• 🔥 https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-vrxf-vrc4-22p7 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-42878 · Security Note
• https://osv.dev/vulnerability/GHSA-vrxf-vrc4-22p7 · Vendor Advisory
• https://github.com/NeoRazorX/facturascripts · Note
• https://reddit.com/r/VulnMatter/comments/1t78zbd/resumen_diario_de_vulnerabilidades_08052026 · Reddit Post
• https://twitter.com/CVEnew/status/2059718105426006448 · Twitter Post