CVE-2026-104905
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
FacturaScripts before version 2026.7 contains a PHP object injection vulnerability in WidgetSelect::processFormData() that allows authenticated attackers to trigger unserialize() on raw POST data without an allowed_classes filter for multiple-select fields. Attackers can submit a serialized XLSXWriter object as the field value to invoke its __destruct() method, deleting arbitrary attacker-specified files such as config.php or backup data, resulting in denial of service and potential application reinstall hijack.
Risk Assessment
The risk includes the possibility of deleting critical configuration files and data, which can cause system unavailability and potentially allow an attacker to take over the application reinstallation process.
Recommendation
It is recommended to immediately upgrade FacturaScripts to version 2026.7 or later and restrict access to POST data processing functions for authenticated users.
Other vulnerabilities in FacturaScripts
See all- CVE-2026-11960Medium
Enumeration of unauthenticated users in FacturaScripts, version 2025.61. The application returns different responses when attempting to log in with a valid username compared to an invalid one. An unauthenticated attacker could systematically identify valid usernames by examining variations in the application's responses, such as changes in response time, discrepancies between error messages or differences in HTTP status codes.
- CVE-2026-11959Medium
A Stored Cross-Site Scripting (XSS) vulnerability exists in FacturaScripts version 2025.61 due to insufficient validation or sanitisation of user input in the 'city' and 'province' fields in the 'ListAlmacen' endpoint. Successful exploitation could allow an attacker to execute arbitrary JavaScript in the victim's browser or escalate privileges from a normal user to an administrator.
- CVE-2026-42879Medium
FacturaScripts is an open source accounting and invoicing software. In 2025.81 and earlier, an authenticated unrestricted file upload vulnerability exists in the product image upload functionality. An attacker with valid credentials can upload a PHP file disguised as a GIF image (using a GIF89a header), bypassing MIME type validation; the file is stored with its original extension, including executable .php. The vulnerability exists in the addImageAction() method of Core/Lib/ExtendedController/ProductImagesTrait.php.
- CVE-2026-42878Medium
FacturaScripts is an open source accounting and invoicing software. Prior to v2026, an unauthenticated information disclosure vulnerability in the Installer controller allows any remote attacker to trigger phpinfo() on a fresh deployment by requesting /?phpinfo=TRUE, exposing full PHP configuration, server environment variables (including database credentials, API keys, and application secrets), filesystem paths, and loaded extensions without authentication.
- CVE-2026-27964Low
FacturaScripts up to version 2025.7 has a Reflected XSS vulnerability via the fsNick cookie parameter. The cookie value is reflected in HTML without sanitization, allowing script execution before redirect. Fixed in version 2025.8.
- CVE-2026-27892Medium
FacturaScripts before version 2026 stores and serves uploaded images without stripping EXIF/XMP/IPTC metadata. Authenticated users can download an image and extract the uploader's personal data such as GPS coordinates, device information, and timestamps.
- CVE-2026-27891High
FacturaScripts versions 2026 and below contain a critical vulnerability in the Plugins::add() function that fails to properly validate file paths within uploaded ZIP archives. This allows a Zip Slip attack, leading to arbitrary file write and remote code execution (RCE) by overwriting sensitive .php files outside the plugins directory.
- CVE-2026-32699Medium
FacturaScripts up to version 2025.92 fails to validate the 'nick' parameter during a POST request to the EditUser controller. Although the UI prevents editing this field, an attacker can intercept the request and modify the parameter to rename any account, including the administrator.
Original NVD description (English source)
FacturaScripts before version 2026.7 contains a PHP object injection vulnerability in WidgetSelect::processFormData() that allows authenticated attackers to trigger unserialize() on raw POST data without an allowed_classes filter for multiple-select fields. Attackers can submit a serialized XLSXWriter object as the field value to invoke its __destruct() method, deleting arbitrary attacker-specified files such as config.php or backup data, resulting in denial of service and potential application reinstall hijack.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS