crater-invoice-inc CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

HIGH crater-invoice-inc CVE published 2026-08-25

CVE-2026-57863

CVE-2026-57863 is a high-severity path traversal vulnerability in Crater Invoice through 6.0.6. Authenticated company owners can write arbitrary files outside the intended extraction directory by supplying crafted ZIP archives with ../ sequences to the unzip endpoint. This allows attackers to write arbitrary PHP files into the web-accessible public directory, potentially leading to remote code execution o [truncated]