CVE-2026-57863
Received Received - Intake

Path Traversal in Crater Invoice Leading to RCE

Publication date: 2026-08-25

Last updated on: 2026-08-25

Assigner: VulnCheck

Description
Crater Invoice through 6.0.6 contains a path traversal vulnerability in the self-update API that allows authenticated company owners to write arbitrary files outside the intended extraction directory by supplying crafted ZIP archives with ../ sequences to the unzip endpoint. Attackers can exploit unsanitized ZIP entry names passed to PHP's ZipArchive::extractTo() to write arbitrary PHP files into the web-accessible public directory and achieve remote code execution on the server.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-25
Last Modified
2026-08-25
Generated
2026-08-25
AI Q&A
2026-08-25
EPSS Evaluated
N/A
NVD
CVE-2026-57863
EUVD
EUVD-2026-65478

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
crater invoice to 6.0.6 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Crater Invoice through version 6.0.6 has a path traversal vulnerability in its self-update API. This flaw allows authenticated company owners to write arbitrary files outside the intended directory by using specially crafted ZIP archives containing ../ sequences. The vulnerability stems from unsanitized ZIP entry names passed to PHP's ZipArchive::extractTo() function, enabling attackers to place arbitrary PHP files in the web-accessible public directory and execute remote code on the server.

Detection Guidance

Check for unauthorized PHP files in the web-accessible public directory, especially those with unusual names or paths. Inspect server logs for suspicious requests to the self-update API endpoint. Monitor for unexpected file writes or modifications outside the intended extraction directory.

Impact Analysis

If exploited, this vulnerability allows attackers to execute arbitrary code on the server, potentially leading to full system compromise. This could result in data theft, unauthorized access to sensitive information, defacement of the website, or use of the server as a launchpad for further attacks. The impact depends on the server's role and the data it handles.

Compliance Impact

This vulnerability could lead to unauthorized access or exposure of sensitive data, violating compliance requirements under GDPR and HIPAA. GDPR mandates strict data protection and breach notification, while HIPAA requires safeguarding protected health information. Exploitation may result in regulatory penalties, legal consequences, and reputational damage.

Mitigation Strategies

Update Crater Invoice to the latest version beyond 6.0.6. Restrict write permissions to the public directory and validate ZIP archive contents before extraction. Disable the self-update API if not required. Implement network monitoring for unusual file creation or execution.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-57863. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart