CVE-2026-27891
published 2026-05-18CVE-2026-27891: FacturaScripts is an open source accounting and invoicing software. Versions 2026 and below contain a critical vulnerability in the Plugins::add() function…
PriorityP350high7.2CVSS 3.1
AVNACLPRHUINSUCHIHAH
EPSS
0.52%
40.3th percentile
FacturaScripts is an open source accounting and invoicing software. Versions 2026 and below contain a critical vulnerability in the Plugins::add() function. The system fails to properly validate the file paths within uploaded ZIP archives. This allows an attacker to perform a Zip Slip attack, leading to Arbitrary File Write and Remote Code Execution (RCE) by overwriting sensitive .php files outside the designated plugins directory. The vulnerability is located in Plugins.php. While the testZipFile function attempts to validate that the ZIP contains only one root folder, it does not sanitize or validate the individual file paths within that folder. An attacker can bypass this check by naming a file ValidPluginName/../../shell.php. The explode function will see ValidPluginName as the root folder, satisfying the count($folders) != 1 check. However, during extraction, the ../../ sequence triggers a path traversal, allowing the file to be written anywhere the web server has permissions the root directory. This issue is fixed in version 2026.1.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| facturascripts | facturascripts | 0 – 2025.71 | — |
| neorazorx | facturascripts | < 2026.1 | 2026.1 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
NeoRazorX FacturaScripts Plugin Upload path traversal (EUVD-2026-30808)
vuldb·2026-05-19·CVSS 7.2
CVE-2026-27891 [HIGH] NeoRazorX FacturaScripts Plugin Upload path traversal (EUVD-2026-30808)
A vulnerability identified as critical has been detected in NeoRazorX FacturaScripts. Affected by this vulnerability is an unknown functionality of the component Plugin Upload Handler. The manipulation leads to path traversal.
This vulnerability is documented as CVE-2026-27891. The attack can be initiated remotely. There is not any exploit available.
GHSA
FacturaScripts Vulnerable to Remote Code Execution (RCE) via Zip Slip in Plugin Upload Mechanism
ghsa·2026-05-07
CVE-2026-27891 [HIGH] CWE-20 FacturaScripts Vulnerable to Remote Code Execution (RCE) via Zip Slip in Plugin Upload Mechanism
FacturaScripts Vulnerable to Remote Code Execution (RCE) via Zip Slip in Plugin Upload Mechanism
### Summary
A Critical vulnerability exists in the `Plugins::add()` function. The system fails to properly validate the file paths within uploaded ZIP archives. This allows an attacker to perform a Zip Slip attack, leading to Arbitrary File Write and Remote Code Execution (RCE) by overwriting sensitive .php files outside the designated plugins directory.
### Details
The vulnerability is located in Plugins.php. While the `testZipFile` function attempts to validate that the ZIP contains only one root folder, it does not sanitize or validate the individual file paths within that folder.
```js
// Vulnerable logic in Plugins.php
for ($index = 0; $index numFiles; $index++) {
$data = $zipFile->statI
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-05-18
Published