Read the docs
TI-2026-29268 Aliases CVE-2026-40521GHSA-9fmm-h59x-wr53

FrontAccounting < 2.4.20 Path Traversal RCE via attachment upload

Priority HIGH 73CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

FrontAccounting before 2.4.20 contains a path traversal vulnerability in the attachment upload handler that allows authenticated attackers to execute arbitrary code by uploading files with traversal sequences in the unique_name parameter. Attackers can supply path traversal sequences ../../../shell.php to write files outside the intended attachments directory into the web root, and by uploading PHP files without extension validation, achieve remote code execution as the web server user.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00977 62nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed FrontAccounting (FrontAccounting): 2.4.20

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
FrontAccountingFrontAccountingbefore 2.4.202.4.20Patch availableCNA
  • FrontAccounting VendorFrontAccounting Affected before 2.4.20 Fixed in 2.4.20 Patch available CNA

Remediation

  • Fix · CNA FrontAccounting (FrontAccounting) Fixed in 2.4.20

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    FrontAccounting 2.4.20

    4 records Highest priority Priority HIGH 3 HIGH, 1 MEDIUM

    Other records, highest priority first

    • TI-2026-29271 FrontAccounting < 2.4.20 SQL Injection via get_gl_transactions()Priority HIGH 65
    • TI-2026-29270 FrontAccounting < 2.4.20 SQL Injection via reporting/rep710.phpPriority HIGH 65
    • TI-2026-29269 FrontAccounting < 2.4.20 SQL Injection via rep601.phpPriority MEDIUM 64
    Show all 4 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-40521
  2. 2026-10-03 Alias added: GHSA-9fmm-h59x-wr53

References

Exploit 1

Patch 1

Other 1

  • TI-2007-04142 PHP remote file inclusion vulnerability in config.php in FrontAccounting 1.12 Build 31… CVSS 2.0HIGH 7.5
  • TI-2026-29271 FrontAccounting < 2.4.20 SQL Injection via get_gl_transactions() CVSS 4.0HIGH 7.2
  • TI-2026-29270 FrontAccounting < 2.4.20 SQL Injection via reporting/rep710.php CVSS 4.0HIGH 7.2
  • TI-2026-29269 FrontAccounting < 2.4.20 SQL Injection via rep601.php CVSS 4.0HIGH 7.1
  • TI-2007-04929 Multiple PHP remote file inclusion vulnerabilities in FrontAccounting (FA) 1.13, when… CVSS 2.0HIGH 9.3
  • TI-2019-04054 includes/db/class.reflines_db.inc in FrontAccounting 2.4.6 contains a SQL Injection… CVSS 3.0CRITICAL 9.8
See all 18 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences