Unrestricted upload of file with dangerous type issue exists in MATCHA INVOICE 2.6.6 and earlier. If this vulnerability is exploited, an arbitrary file may be created by an administrator of the product. As a result, arbitrary code may be executed on the server.

Unrestricted upload of file with dangerous type issue exists in MATCHA INVOICE 2.6.6 and earlier. If this vulnerability is exploited, an arbitrary file may be created by an administrator of the product. As a result, arbitrary code may be executed on the server.

MATCHA series provided by ICZ Corporation contains multiple vulnerabilities listed below.<a href='https://cwe.mitre.org/data/definitions/89.html' target='_blank'></a><a href='https://cwe.mitre.org/data/definitions/79.html' target='_blank'></a><a href='https://cwe.mitre.org/data/definitions/434.html' target='_blank'></a><ul><li>SQL injection (CWE-89) - CVE-2026-24913</li><li>Cross-site scripting (CWE-79) - CVE-2026-27787</li><li>Unrestricted upload of file with dangerous type(CWE-434) - CVE-2026-33273</li></ul>CVE-2026-24913, CVE-2026-27787 Kenta Chikagawa of Mitsui Bussan Secure Directions, Inc. reported these vulnerabilities to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. CVE-2026-33273 Shoji Baba reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.