7.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-27891

CVE-2026-27891: Remote Code Execution (RCE) via Zip Slip in Plugin Upload Mechanism

FacturaScripts is an open source accounting and invoicing software. Versions 2026 and below contain a critical vulnerability in the Plugins::add() function. The system fails to properly validate the file paths within uploaded ZIP archives. This allows an attacker to perform a Zip Slip attack, leading to Arbitrary File Write and Remote Code Execution (RCE) by overwriting sensitive .php files outside the designated plugins directory. The vulnerability is located in Plugins.php. While the testZipFile function attempts to validate that the ZIP contains only one root folder, it does not sanitize or validate the individual file paths within that folder. An attacker can bypass this check by naming a file ValidPluginName/../../shell.php. The explode function will see ValidPluginName as the root folder, satisfying the count($folders) != 1 check. However, during extraction, the ../../ sequence triggers a path traversal, allowing the file to be written anywhere the web server has permissions the root directory. This issue is fixed in version 2026.1.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-27891

CVE-2026-27891:

7.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
facturascripts/facturascripts	composer	<= 2025.71

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic Zip Slip issue within the plugin upload functionality of FacturaScripts. The root cause lies in the FacturaScripts\Core\Plugins::testZipFile function, which is responsible for validating uploaded plugin archives. The validation is incomplete; while it checks for a single root directory within the ZIP file, it fails to sanitize or check for path traversal sequences (../) in the filenames of the archive's contents. An attacker can create a ZIP file containing a malicious payload (e.g., a PHP shell) with a crafted filename like ValidPluginName/../../shell.php. The testZipFile function will incorrectly approve this archive. The FacturaScripts\Core\Plugins::add function then calls this flawed validation function. Upon receiving a 'valid' response, it proceeds to extract the archive using ZipArchive::extractTo. The path traversal sequence in the filename is processed by the file system, causing the malicious file to be written outside of the intended Plugins directory, leading to arbitrary file write and potential remote code execution.

Vulnerable functions

FacturaScripts\Core\Plugins::add

Core/Plugins.php

This function orchestrates the plugin upload process. It relies on the `testZipFile` function to validate the uploaded ZIP archive. Because the validation in `testZipFile` is flawed in vulnerable versions, the subsequent call to `$zipFile->extractTo()` within the `add` function leads to a Zip Slip vulnerability, allowing an attacker to write files to arbitrary locations on the server.

FacturaScripts\Core\Plugins::testZipFile

Core/Plugins.php

This function is responsible for validating the plugin ZIP archive. The vulnerability lies in its failure to check for path traversal sequences (like `../`) in the file paths within the archive. It only checks if the archive has a single root directory. This allows an attacker to craft a malicious ZIP file with a path like `PluginName/../../shell.php` which bypasses this check, but is later exploited during extraction.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.