Skip to content
OpenAdvisories
Medium · 6.3 Public exploit CVE-2026-42879 EUVD-2026-32626GHSA-vf3q-frmr-vrr9

FacturaScripts: Authenticated Remote Code Execution (RCE) via GIF Image Upload in Product Images

Published May 27, 2026 · Updated Jun 1, 2026 · Assigned by GitHub_M

Vendor: NeoRazorX Product: facturascripts Package: facturascripts/facturascripts Ecosystem: Packagist

Description

FacturaScripts is an open source accounting and invoicing software. In 2025.81 and earlier, an authenticated unrestricted file upload vulnerability exists in FacturaScripts' product image upload functionality. An attacker with valid credentials can upload a PHP file disguised as a GIF image (using a GIF89a header), bypassing MIME type validation. The file is stored with its original extension, including executable extensions such as .php. The vulnerability exists the addImageAction() method of Core/Lib/ExtendedController/ProductImagesTrait.php.

Affected products

VendorProductAffectedFixed
NeoRazorX facturascripts <= 2025.81 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
Packagist facturascripts/facturascripts <= 2025.81 — GHSA-vf3q-frmr-vrr9

References