CVE-2026-27891
Zip Slip Arbitrary File Write in FacturaScripts
Publication date: 2026-05-18
Last updated on: 2026-05-19
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| facturascripts | facturascripts | to 2026.1 (exc) |
| facturascripts | facturascripts | 2026.1 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-434 | The product allows the upload or transfer of dangerous file types that are automatically processed within its environment. |
| CWE-20 | The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in FacturaScripts, an open source accounting and invoicing software, specifically in versions 2026 and below. It is found in the Plugins::add() function where the system fails to properly validate file paths inside uploaded ZIP archives.
An attacker can exploit this by crafting a ZIP file that appears to have a valid root folder but contains files with path traversal sequences like "../../". This allows the attacker to write files outside the intended plugins directory, potentially overwriting sensitive .php files.
This type of attack is known as a Zip Slip attack, which can lead to Arbitrary File Write and Remote Code Execution (RCE) on the server hosting the application.
How can this vulnerability impact me? :
Exploitation of this vulnerability can allow an attacker to overwrite critical PHP files on the server, leading to Remote Code Execution (RCE).
This means the attacker could execute arbitrary code with the permissions of the web server, potentially gaining control over the affected system.
Such control could lead to data theft, data manipulation, service disruption, or further compromise of the network.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, upgrade FacturaScripts to version 2026.1 or later, where the issue has been fixed.
Avoid using vulnerable versions (2026 and below) of FacturaScripts, especially the Plugins::add() function that handles ZIP archive uploads.
Restrict file upload permissions and carefully monitor any plugin uploads to prevent exploitation of the Zip Slip vulnerability.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows an attacker to perform arbitrary file writes and remote code execution by exploiting a Zip Slip path traversal in the plugin upload mechanism. This can lead to unauthorized access and modification of sensitive files, potentially compromising the confidentiality, integrity, and availability of data managed by the software.
Such a compromise could impact compliance with common standards and regulations like GDPR and HIPAA, which require protection of sensitive personal and health information. Unauthorized code execution and file manipulation could result in data breaches or unauthorized data exposure, violating these regulations' requirements for data security and privacy.
Therefore, until the vulnerability is fixed (in version 2026.1), systems using affected versions of FacturaScripts may be at increased risk of non-compliance with these standards due to the potential for unauthorized data access and modification.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves a Zip Slip path traversal during plugin ZIP archive extraction in FacturaScripts versions 2026 and below. Detection can focus on identifying suspicious ZIP files containing file paths with directory traversal sequences such as "../" or "..\" inside the archive.
One approach is to inspect plugin ZIP files before installation to check for unsafe paths. For example, you can use the unzip command with the -l option to list files and grep for traversal patterns:
- unzip -l suspicious_plugin.zip | grep -E '(\.\./|\.\.\\)'
Additionally, monitoring file system changes for unexpected .php files outside the plugins directory or unusual modifications can help detect exploitation attempts.
Since the vulnerability allows arbitrary file writes and remote code execution, reviewing web server logs for suspicious requests or newly created PHP files in unexpected locations may also be useful.