Priority HIGH 73
Crater Invoice through 6.0.6 contains a path traversal vulnerability in the self-update API that allows authenticated company owners to write arbitrary files outside the intended extraction directory by supplying crafted…
CVSS 4.0HIGH 8.7· Network · Low privileges · No interaction · EPSS 0.00899 · Published 2026-08-25 · No fix listed CWE-22
Priority LOW 38
Crater's NotePolicy checks only a blanket Bouncer ability (manage-all-notes / view-all-notes) with no company-ownership comparison, unlike InvoicePolicy and other sibling policies which additionally verify ->hasCompany(-…
CVSS 3.1HIGH 8.2· Network · Low privileges · No interaction · EPSS 0.00374 · Published 2026-08-05 · No fix listed CWE-639
Priority LOW 38
Crater isolates data per company_id, and its Invoice/Estimate/Payment/Expense policies enforce both a Bouncer ability check and ->hasCompany(->company_id).
CVSS 3.1HIGH 8.2· Network · Low privileges · No interaction · EPSS 0.00374 · Published 2026-08-05 · No fix listed CWE-639
Priority MEDIUM 56
A weakness has been identified in crater-invoice-inc crater up to 6.0.6.
CVSS 4.0MEDIUM 5.1· Network · Low privileges · User interaction · EPSS 0.00348 · Published 2026-07-06 · No fix listed CWE-79
Priority MEDIUM 52
/api/v1/company/upload-logo in CompanyController.php in crater through 6.0.6 allows a superadmin to execute arbitrary PHP code by placing this code into an image/png IDAT chunk of a Company Logo image.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.23799 · Published 2023-10-30 · No fix listed CWE-94
Priority LOW 35
Insecure deserialization of not validated module file in GitHub repository crater-invoice/crater prior to 6.0.6.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.01604 · Published 2022-03-29 · Fixed in 6.0.6 CWE-502
Priority LOW 36
Unrestricted Upload of File with Dangerous Type in GitHub repository crater-invoice/crater prior to 6.0.6.
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00925 · Published 2022-03-23 · Fixed in 6.0.6 CWE-434
Priority LOW 20
Cross-Site Request Forgery (CSRF) in GitHub repository crater-invoice/crater prior to 6.0.4.
CVSS 3.1MEDIUM 4.3· Network · No auth · User interaction · EPSS 0.00429 · Published 2022-03-21 · Fixed in 6.0.4 CWE-352
Priority LOW 31
Business Logic Errors in GitHub repository crater-invoice/crater prior to 6.0.5.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00956 · Published 2022-03-21 · Fixed in 6.0.5 CWE-840
Priority LOW 25
Cross-site Scripting (XSS) - Stored in Packagist bytefury/crater prior to 6.0.2.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00613 · Published 2022-01-27 · Fixed in 6.0.2, 6.0.0 CWE-79
Priority LOW 26
Improper Access Control in GitHub repository crater-invoice/crater prior to 6.0.2.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.01213 · Published 2022-01-26 · Fixed in 6.0.2 CWE-284
Priority LOW 35
Unrestricted Upload of File with Dangerous Type in GitHub repository crater-invoice/crater prior to 6.0.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.01413 · Published 2022-01-17 · Fixed in 6.0 CWE-434
Priority MEDIUM 41
crater is vulnerable to Unrestricted Upload of File with Dangerous Type
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.01522 · Published 2022-01-12 · Fixed in 6.0.0 CWE-434
THREATIST.IORead the docs