CVE-2026-33273 ICZ Corporation CVE debrief

Who should care

Administrators and users of MATCHA INVOICE 2.6.6 and earlier should be aware of this vulnerability, as it allows for unrestricted file uploads with dangerous types, potentially leading to arbitrary code execution on the server. This issue is particularly concerning for organizations that use MATCHA INVOICE for critical business operations, as exploitation could lead to significant financial and reputational damage.

Technical summary

A vulnerability in MATCHA INVOICE 2.6.6 and earlier allows for unrestricted upload of files with dangerous types. If exploited, an administrator of the product may create an arbitrary file, potentially leading to arbitrary code execution on the server. The CVSS score for this vulnerability is 5.1, indicating a medium severity. This issue is particularly concerning as it could allow attackers to execute code on the server, potentially leading to significant damage.

Defensive priority

Medium priority should be given to patching or mitigating this vulnerability, as it could lead to significant damage if exploited. However, given the potential impact, it is recommended that administrators take immediate action to verify the version of MATCHA INVOICE in use and apply patches or updates as soon as possible.

Recommended defensive actions

• Inventory and verify the version of MATCHA INVOICE in use
• Apply patches or updates provided by the vendor, if available
• Implement compensating controls, such as restricting file uploads or monitoring for suspicious activity
• Consider disabling or limiting the functionality of file uploads, if possible
• Review and update incident response plans to account for potential exploitation of this vulnerability
• Conduct regular security audits to identify and address potential vulnerabilities
• Provide training to administrators and users on secure file upload practices and the importance of patching vulnerabilities

Evidence notes

The CVE record and NVD detail provide information on the vulnerability, including its description, CVSS score, and affected versions. Two additional references are provided: a Third Party Advisory and a Vendor Advisory. The vulnerability has not been modified since its initial publication on 2026-04-08T06:16:28.647Z. The NVD entry is currently Analyzed, indicating that it has been thoroughly reviewed and verified.

Official resources