Medium severity · published May 27, 2026
CVE-2026-42879
FacturaScripts: Authenticated Remote Code Execution (RCE) via GIF Image Upload in Product Images
6.3
CVSS
0.2%
EPSS
No
On KEV
Description
FacturaScripts is an open source accounting and invoicing software. In 2025.81 and earlier, an authenticated unrestricted file upload vulnerability exists in FacturaScripts' product image upload functionality. An attacker with valid credentials can upload a PHP file disguised as a GIF image (using a GIF89a header), bypassing MIME type validation. The file is stored with its original extension, including executable extensions such as .php. The vulnerability exists the addImageAction() method of Core/Lib/ExtendedController/ProductImagesTrait.php.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 14% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FA
facturascripts · NeoRazorX
<= 2025.81 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-42879
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-42879
github.com
https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-vf3q-frmr-vrr9
More from facturascripts
9.0
CVE-2026-23997
FacturaScripts has a Stored Cross-Site Scripting (XSS) in "Observations" field via History View
8.8
CVE-2026-25513
FacturaScripts has SQL Injection vulnerability in API ORDER BY Clause
8.8
CVE-2026-25514
FacturaScripts has SQL Injection vulnerability in Autocomplete Actions
8.1
CVE-2026-104905
FacturaScripts < 2026.7 PHP Object Injection via WidgetSelect
7.2
CVE-2026-27891
Remote Code Execution (RCE) via Zip Slip in Plugin Upload Mechanism