https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 13:09:25 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-323532 EUVD-2026-323532 https://cve.radiocsirt.org/vuln/euvd-2026-323532 https://cve.radiocsirt.org/vuln/fkie_cve-2026-42879 <p>FacturaScripts is an open source accounting and invoicing software. In 2025.81 and earlier, an authenticated unrestricted file upload vulnerability exists in FacturaScripts&#39; product image upload functionality. An attacker with valid credentials can upload a PHP file disguised as a GIF image (using a GIF89a header), bypassing MIME type validation. The file is stored with its original extension, including executable extensions such as .php. The vulnerability exists the addImageAction() method of Core/Lib/ExtendedController/ProductImagesTrait.php.</p> <p>FacturaScripts is an open source accounting and invoicing software. In 2025.81 and earlier, an authenticated unrestricted file upload vulnerability exists in FacturaScripts&#39; product image upload functionality. An attacker with valid credentials can upload a PHP file disguised as a GIF image (using a GIF89a header), bypassing MIME type validation. The file is stored with its original extension, including executable extensions such as .php. The vulnerability exists the addImageAction() method of Core/Lib/ExtendedController/ProductImagesTrait.php.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-42879 https://cve.radiocsirt.org/vuln/ghsa-vf3q-frmr-vrr9 <p><strong>Affected:</strong> Packagist: facturascripts/facturascripts</p> <p># CVE-2026-42879 - FacturaScripts - Authenticated Unrestricted File Upload via MIME Type Bypass ## Summary An authenticated unrestricted file upload vulnerability exists in FacturaScripts&#39; product image upload functionality. An attacker with valid credentials can upload a PHP file disguised as a GIF image (using a GIF89a header), bypassing MIME type validation. The file is stored with its original extension, including executable extensions such as .php. --- ## Details The vulnerability exists in: `Core/Lib/ExtendedController/ProductImagesTrait.php` Specifically in the `addImageAction()` method. ### Vulnerable Code ```php if (false === strpos($uploadFile-&gt;getMimeType(), &#39;image/&#39;)) { Tools::log()-&gt;error(&#39;file-not-supported&#39;); continue; } $folder = Tools::folder(&#39;MyFiles&#39;); Tools::folderCheckOrCreate($folder); $uploadFile-&gt;move($folder, $uploadFile-&gt;getClientOriginalName()); ``` ### Root Cause - The validation only checks if MIME type contains `&#34;image/&#34;` - This can be bypassed by prepending **GIF89a magic bytes** to a PHP file - The system incorrectly identifies the file as `image/gif` - The file is saved with a `.php` extension in a web-accessible directory ### File Storage Behavior Uploaded files are stored in: ``` /MyFiles/YYYY/MM/X.php ``` Where `X` is an auto-incrementing ID. This allows direct remote execution: ``` http://target/MyFiles/2026/03/2.php?cmd=id ``` --- ## Impact Successful exploitation:</p> <p>An attacker may upload f…</p> <p><strong>Affected:</strong> Packagist: facturascripts/facturascripts</p> <p># CVE-2026-42879 - FacturaScripts - Authenticated Unrestricted File Upload via MIME Type Bypass ## Summary An authenticated unrestricted file upload vulnerability exists in FacturaScripts&#39; product image upload functionality. An attacker with valid credentials can upload a PHP file disguised as a GIF image (using a GIF89a header), bypassing MIME type validation. The file is stored with its original extension, including executable extensions such as .php. --- ## Details The vulnerability exists in: `Core/Lib/ExtendedController/ProductImagesTrait.php` Specifically in the `addImageAction()` method. ### Vulnerable Code ```php if (false === strpos($uploadFile-&gt;getMimeType(), &#39;image/&#39;)) { Tools::log()-&gt;error(&#39;file-not-supported&#39;); continue; } $folder = Tools::folder(&#39;MyFiles&#39;); Tools::folderCheckOrCreate($folder); $uploadFile-&gt;move($folder, $uploadFile-&gt;getClientOriginalName()); ``` ### Root Cause - The validation only checks if MIME type contains `&#34;image/&#34;` - This can be bypassed by prepending **GIF89a magic bytes** to a PHP file - The system incorrectly identifies the file as `image/gif` - The file is saved with a `.php` extension in a web-accessible directory ### File Storage Behavior Uploaded files are stored in: ``` /MyFiles/YYYY/MM/X.php ``` Where `X` is an auto-incrementing ID. This allows direct remote execution: ``` http://target/MyFiles/2026/03/2.php?cmd=id ``` --- ## Impact Successful exploitation:</p> <p>An attacker may upload f…</p> https://cve.radiocsirt.org/vuln/ghsa-vf3q-frmr-vrr9