Skip to content
OpenAdvisories

Vendor

crater-invoice

12 known vulnerabilities.

Products

crater-invoice/crater 8 crater 4
All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • High 8.8
    CVE-2026-57863

    Crater Invoice 6.0.6 Path Traversal RCE via update/unzip endpoint

    Crater Invoice through 6.0.6 contains a path traversal vulnerability in the self-update API that allows authenticated company owners to write arbitrary files outside the intended extraction directory by supplying crafted ZIP archives with ../ sequences to the…

    crater-invoice crater
  • High 8.2
    CVE-2026-71242

    Crater - Cross-Company IDOR on Notes via Missing Company-Ownership Check in NotePolicy

    Crater's NotePolicy checks only a blanket Bouncer ability (manage-all-notes / view-all-notes) with no company-ownership comparison, unlike InvoicePolicy and other sibling policies which additionally verify ->hasCompany(->company_id). Any authenticated user of…

    crater-invoice crater
  • High 8.2
    CVE-2026-55739

    Crater - Missing Tenant-Ownership Check in CustomerPolicy Allows Cross-Company Customer Data Theft and Deletion

    Crater isolates data per company_id, and its Invoice/Estimate/Payment/Expense policies enforce both a Bouncer ability check and ->hasCompany(->company_id). CustomerPolicy's view/update/delete methods omit the company-ownership check entirely, checking only th…

    crater-invoice crater
  • High 7.2
    CVE-2022-1032

    Insecure deserialization of not validated module file in crater-invoice/crater

    Insecure deserialization of not validated module file in GitHub repository crater-invoice/crater prior to 6.0.6.

    crater-invoice crater-invoice/crater
  • High 7.2
    CVE-2022-1033

    Unrestricted Upload of File with Dangerous Type in crater-invoice/crater

    Unrestricted Upload of File with Dangerous Type in GitHub repository crater-invoice/crater prior to 6.0.6.

    crater-invoice crater-invoice/crater
  • High 7.6
    CVE-2022-0372

    Cross-site Scripting (XSS) - Stored in crater-invoice/crater

    Cross-site Scripting (XSS) - Stored in Packagist bytefury/crater prior to 6.0.2.

    crater-invoice crater-invoice/crater bytefury/crater Packagist
  • High 7.5
    CVE-2022-0203

    Improper Access Control in crater-invoice/crater

    Improper Access Control in GitHub repository crater-invoice/crater prior to 6.0.2.

    crater-invoice crater-invoice/crater bytefury/crater Packagist
  • High 7.2
    CVE-2022-0242

    Unrestricted Upload of File with Dangerous Type in crater-invoice/crater

    Unrestricted Upload of File with Dangerous Type in GitHub repository crater-invoice/crater prior to 6.0.

    crater-invoice crater-invoice/crater bytefury/crater Packagist
  • High 8.8
    CVE-2021-4080

    Unrestricted Upload of File with Dangerous Type in crater-invoice/crater

    crater is vulnerable to Unrestricted Upload of File with Dangerous Type

    crater-invoice crater-invoice/crater bytefury/crater Packagist