CVE-2026-45263 facturascripts CVE debrief

Who should care

Administrators and users of FacturaScripts, especially those with low-privilege accounts, should be aware of this vulnerability and take necessary actions to mitigate it. They should review and update FacturaScripts to the latest version, restrict export privileges, and implement additional input validation and sanitization for CSV exports. Security teams and vulnerability management teams should also be aware of this vulnerability and monitor for any new

Why it matters

CVE-2026-45263 is a high-severity vulnerability in FacturaScripts that allows low-privilege users to inject malicious formulas into CSV exports. When an admin opens the export, the payload executes, potentially leading to arbitrary command execution on the admin workstation. This vulnerability requires immediate attention from administrators and users of FacturaScripts to mitigate the risk of exploitation.

• Authenticated low-privilege users can plant payloads that execute on the admin workstation when the export is opened
• Execution of arbitrary commands or processes on the admin workstation
• Potential for lateral movement or further exploitation within the network
• Verification of patch deployment and monitoring for suspicious activity are crucial

Technical summary

The vulnerability exists in the CSVExport feature of FacturaScripts, allowing low-privilege users to inject malicious formulas into the CSV export. When an admin opens the exported file in spreadsheet applications like Excel or LibreOffice, the payload is executed. The issue involves a low-privilege user creating a customer with a malicious payload that executes when an admin exports the data to CSV and opens it in spreadsheet applications. The downstream consumer is the admin who triggered the export, giving the attacker a reliable handoff: low-priv user plants a payload in any customer name, and the admin executes it when opening the export.

Defensive priority

High

Recommended defensive actions

• Review and update FacturaScripts to version 2026.2 or later
• Restrict export privileges to trusted users
• Implement additional input validation and sanitization for CSV exports
• Monitor for suspicious activity related to CSV exports
• Verify patch deployment and monitor for suspicious activity
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability was verified with a live PoC on 2026-04-30 against a stock FacturaScripts master. The issue involves a low-privilege user creating a customer with a malicious payload that executes when an admin exports the data to CSV and opens it in spreadsheet applications like Excel or LibreOffice.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.