TI-2026-22235 Aliases CVE-2026-27891 GHSA-3pgc-xqg9-cfr6

Remote Code Execution (RCE) via Zip Slip in Plugin Upload Mechanism

HIGH 67CWE-20Published 2026-05-18 · Updated 2026-05-19

Key facts

Attack vector: Network
Privileges required: High
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-434.

Summary

FacturaScripts is an open source accounting and invoicing software. Versions 2026 and below contain a critical vulnerability in the Plugins::add() function. The system fails to properly validate the file paths within uploaded ZIP archives. This allows an attacker to perform a Zip Slip attack, leading to Arbitrary File Write and Remote Code Execution (RCE) by overwriting sensitive .php files outside the designated plugins directory. The vulnerability is located in Plugins.php. While the testZipFile function attempts to validate that the ZIP contains only one root folder, it does not sanitize or validate the individual file paths within that folder. An attacker can bypass this check by naming a file ValidPluginName/../../shell.php. The explode function will see ValidPluginName as the root folder, satisfying the count($folders) != 1 check. However, during extraction, the ../../ sequence triggers a path traversal, allowing the file to be written anywhere the web server has permissions the root directory. This issue is fixed in version 2026.1.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00522 44th percentileScored 2026-11-07

Fix Fixed facturascripts (NeoRazorX): 2026.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
NeoRazorX	facturascripts	before 2026.1	2026.1	Patch available	CNA
—	facturascripts/facturascripts (Packagist)	up to 2025.71	—	No fix listed	GHSA-3pgc-xqg9-cfr6

facturascripts VendorNeoRazorX Affected before 2026.1 Fixed in 2026.1 Patch available CNA
facturascripts/facturascripts (Packagist) Vendor— Affected up to 2025.71 Fixed in — No fix listed GHSA-3pgc-xqg9-cfr6

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:facturascripts:facturascripts::::::::	—	—	NeoRazorX

cpe:2.3:a:facturascripts:facturascripts:*:*:*:*:*:*:*:* Versions — — ·NeoRazorX

Remediation

Fix · CNA facturascripts (NeoRazorX) Fixed in 2026.1

Timeline

2026-10-02 Threatist record created from CVE-2026-27891
2026-10-03 Alias added: GHSA-3pgc-xqg9-cfr6
2026-10-25 EPSS moved to the below the 50th percentile

References

Other 3

TI-2026-19336 FacturaScripts has a Stored Cross-Site Scripting (XSS) in "Observations" field via History View CVSS 3.1CRITICAL 9.0
TI-2026-31084 FacturaScripts: Unauthenticated phpinfo() Disclosure via Installer Endpoint in FacturaScripts CVSS 3.1MEDIUM 5.3
TI-2026-67841 PHP object injection in FacturaScripts via WidgetSelect CVSS 4.0MEDIUM 6.1
TI-2026-22236 FacturaScripts: Unstripped Image Metadata (EXIF) Leakage via Library Module File Upload/Download CVSS 3.1MEDIUM 6.5
TI-2026-31083 FacturaScripts: Stored XSS via product reference in sales/purchases CVSS 3.1MEDIUM 5.4
TI-2026-25191 FacturaScripts unauthorized modification of immutable nick field via EditUser controller CVSS 4.0MEDIUM 5.3

See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences