CVE-2026-33273
Unrestricted File Upload in MATCHA INVOICE Allows Code Execution
Publication date: 2026-04-08
Last updated on: 2026-04-17
Assigner: JPCERT/CC
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| icz | matcha_invoice | to 2.6.6 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-434 | The product allows the upload or transfer of dangerous file types that are automatically processed within its environment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in MATCHA INVOICE version 2.6.6 and earlier, where there is an unrestricted upload of files with dangerous types. If exploited, an administrator of the product can create arbitrary files on the server.
As a result, arbitrary code may be executed on the server, potentially compromising the system.
How can this vulnerability impact me? :
If this vulnerability is exploited, it allows an administrator to upload arbitrary files that can lead to execution of arbitrary code on the server.
This can result in unauthorized actions, data compromise, or disruption of service on the affected system.