CVE-2026-77526 Facturascripts CVE debrief

Who should care

System administrators, security teams, and developers responsible for FacturaScripts installations, particularly those with exposed web interfaces or integrations with external systems, should assess their exposure and prioritize remediation.

Why it matters

CVE-2026-77526 is a critical vulnerability in FacturaScripts that allows authenticated users to write files to arbitrary locations, potentially leading to remote code execution. Defenders should prioritize remediation, restrict write permissions, and monitor for suspicious activity.

• Potential for remote code execution
• Arbitrary file write capabilities
• Escalation of privileges for authenticated users
• Possible data breaches or system compromise

Technical summary

The `UploadedFile::move()` method in FacturaScripts is vulnerable to path traversal attacks, allowing an authenticated user to write uploaded content to any directory writable by the web-server user. This can lead to remote code execution when combined with specific directory configurations and the absence of certain files from the `BLOCKED_EXTENSIONS` list. The vulnerability arises from the unsanitized use of `UploadedFile::getClientOriginalName()` as `$destinyName`, enabling attackers to escape the intended `MyFiles/` location. The shipped `htaccess-sample` excludes certain directories from the `index.php` rewrite, and `.htaccess` not being in `BLOCKED_EXTENSIONS` enables the primitive to escalate to remote

Defensive priority

High

Recommended defensive actions

• Review and update FacturaScripts to version 2026.3 or later
• Verify and restrict write permissions for the web-server user
• Monitor for suspicious file uploads and directory traversal attempts
• Implement additional security measures, such as Web Application Firewalls (WAFs) and intrusion detection systems
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability exists in the `UploadedFile::move()` method of FacturaScripts, which allows an authenticated user to write uploaded content to any directory writable by the web-server user, potentially leading to remote code execution.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.