{"id":"GHSA-3pgc-xqg9-cfr6","aliases":["CVE-2026-27891"],"title":"FacturaScripts Vulnerable to Remote Code Execution (RCE) via Zip Slip in Plugin Upload Mechanism","titleSource":"OSV","descriptionSource":"OSV","declaredSeverity":"HIGH","description":"### Summary\nA Critical vulnerability exists in the `Plugins::add()` function. The system fails to properly validate the file paths within uploaded ZIP archives. This allows an attacker to perform a Zip Slip attack, leading to Arbitrary File Write and Remote Code Execution (RCE) by overwriting sensitive .php files outside the designated plugins directory.\n\n### Details\nThe vulnerability is located in Plugins.php. While the `testZipFile` function attempts to validate that the ZIP contains only one root folder, it does not sanitize or validate the individual file paths within that folder.\n```js\n// Vulnerable logic in Plugins.php\nfor ($index = 0; $index < $zipFile->numFiles; $index++) {\n    $data = $zipFile->statIndex($index);\n    $path = explode('/', $data['name']);\n    if (count($path) > 1) {\n        $folders[$path[0]] = $path[0];\n    }\n} \n```\nAn attacker can bypass this check by naming a file `ValidPluginName/../../shell.php`. The explode function will see ValidPluginName as the root folder, satisfying the `count($folders) != 1` check. However, during extraction, the `../../` sequence triggers a path traversal, allowing the file to be written anywhere the web server has permissions the root directory.\n### PoC\nPrepare Malicious ZIP: Use a tool (like evilarc) or a script to create a ZIP file where one of the entries is named: `MyPlugin/../../rce.php`\nInject Payload: Inside rce.php, put a simple shell: \n`<?php system($_GET['cmd']); ?>`\nUpload: Navigate to the \"Add Plugin\" section in FacturaScripts and upload the malicious ZIP.\nExecution: Access the shell via https://target.com/rce.php?cmd=whoami.\n\n### Impact\nConfidentiality: High (Attacker can read all database configs and files).\nIntegrity: High (Attacker can modify any file on the server).\nAvailability: High (Attacker can delete the entire installation).\n> https://github.com/ZeroXJacks/CVEs/blob/main/2026/CVE-2026-27891.md","severity":"high","score":7.2,"published":"2026-05-07T19:32:14.000Z","modified":"2026-05-07T19:56:27.875Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"facturascripts/facturascripts","sources":[{"name":"OSV · GHSA-3pgc-xqg9-cfr6","url":"https://osv.dev/vulnerability/GHSA-3pgc-xqg9-cfr6"}],"ranges":[{"events":[{"introduced":"0"},{"last_affected":"2025.71"}],"type":"ECOSYSTEM"}],"versions":["2018.03","2018.04","2018.05","2018.11","v2018.12","v2018.13","v2018.14","v2018.15","v2018.16","v2020.01","v2020.2","v2020.3","v2020.4","v2020.51","v2020.61","v2020.71","v2020.80","v2021","v2021.1","v2021.2","v2021.4","v2021.51","v2021.71","v2021.81","v2022.06","v2022.08","v2022.2","v2022.4","v2022.51","v2023.03","v2023.08","v2023.16","v2023.21","v2024","v2024.1","v2024.2","v2024.3","v2024.5","v2024.7","v2024.8","v2024.9","v2024.91","v2024.93","v2024.94","v2024.95","v2024.96","v2025","v2025.11","v2025.2","v2025.3","v2025.4","v2025.41","v2025.43","v2025.7","v2025.71","v2025.8"],"fixed":[]}],"sourceAffected":[],"references":["https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-3pgc-xqg9-cfr6","https://github.com/NeoRazorX/facturascripts"],"sources":[{"name":"OSV","id":"GHSA-3pgc-xqg9-cfr6","modified":"2026-05-07T19:56:27.875430Z","url":"https://osv.dev/vulnerability/GHSA-3pgc-xqg9-cfr6"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","score":7.2}],"products":[],"remediation":[],"kev":{"status":"not-listed","checkedAt":"2026-10-28T20:25:31.474Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}