5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-42878

CVE-2026-42878: FacturaScripts: Unauthenticated phpinfo() Disclosure via Installer Endpoint in FacturaScripts

FacturaScripts is an open source accounting and invoicing software. Prior to v2026, an unauthenticated information disclosure vulnerability in the Installer controller allows any remote attacker to trigger phpinfo() on a fresh FacturaScripts deployment by requesting /?phpinfo=TRUE, exposing full PHP configuration, server environment variables (including any database credentials, API keys, or application secrets set as env vars), filesystem paths, and loaded extensions without being authenticated. This vulnerability is fixed in v2026.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-42878

CVE-2026-42878:

5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
facturascripts/facturascripts	composer	>= 2026, <= 2026.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is an unauthenticated information disclosure in the installer of FacturaScripts. It was introduced in commit 8c31c1060581ad6ad591c7689da3a8df8a29f486. This commit adds a check for a phpinfo query parameter in the constructor of the AppInstaller class in Core/App/AppInstaller.php. If the parameter is present and set to TRUE, the phpinfo() function is called, which prints out sensitive information about the PHP environment, including environment variables, configuration, and more. This endpoint is accessible without authentication on a fresh installation of FacturaScripts. The vulnerable function is the constructor of the AppInstaller class, AppInstaller.__construct. While the security advisory mentions the file path as Core/Controller/Installer.php, the provided commit that introduced the vulnerability clearly shows the code being added to Core/App/AppInstaller.php. It is likely the file was moved or renamed in a later version of the application.

Vulnerable functions

AppInstaller.__construct

Core/App/AppInstaller.php

The constructor of the AppInstaller class checks for a 'phpinfo' query parameter. If the parameter is set to 'TRUE', it calls the `phpinfo()` function, which exposes sensitive server information. This occurs before any authentication is performed, leading to an unauthenticated information disclosure vulnerability.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.