FacturaScripts: Path traversal in UploadedFile::move() via getClientOriginalName() — arbitrary file write outside MyFiles/ leading to RCE
Packagist facturascripts/facturascripts · Upgrade to 2026.3 or later · >= 2025, < 2026.3 · CVE-2026-77526 · GHSA-hgjx-r89m-m7v4 · amended