FacturaScripts Vulnerable to Authenticated Remote Code Execution (RCE) via GIF Image Upload in Product Images

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS

6.3 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

EPSS

• CVE-2026-42879: 0.23% estimated exploitation activity in the next 30 days; percentile 13.82 (FIRST EPSS, 2026-11-03). This is a model estimate, not proof of exploitation or customer exposure.

As published by the source; long descriptions are shortened.

CVE-2026-42879 - FacturaScripts - Authenticated Unrestricted File Upload via MIME Type Bypass Summary An authenticated unrestricted file upload vulnerability exists in FacturaScripts' product image upload functionality. An attacker with valid credentials can upload a PHP file disguised as a GIF image (using a GIF89a header), bypassing MIME type validation. The file is stored with its original extension, including executable extensions such as .php. --- Details The vulnerability exists in: Core/Lib/ExtendedController/ProductImagesTrait.php Specifically in the addImageAction() method. Vulnerable Code Root Cause - The validation only checks if MIME type contains "image/" - This can be bypassed by prepending GIF89a magic bytes to a PHP file - The system incorrectly identifies the file as image/gif - The file is saved with a .php extension in a web-accessible directory File Storage Behavior Uploaded files are stored in: Where X is an auto-incrementing ID. This allows direct remote…

Published by the source

7 May 2026, 19:49 UTC

Last modified by the source

8 Jun 2026, 23:53 UTC

Source last checked

26 Oct 2026, 14:48 UTC

1. Revision 1 · created · 26 Oct 2026

   Published from ghsa record GHSA-vf3q-frmr-vrr9

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: CVE-2026-42879

Advisory: FacturaScripts Vulnerable to Authenticated Remote Code Execution (RCE) via GIF Image Upload in Product Images
IDs: CVE-2026-42879, GHSA-vf3q-frmr-vrr9
Record: https://patchnext.com/advisories/cve-2026-42879 (revision 1, source checked 26 Oct 2026, 14:48 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: Medium (CVSS 6.3)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Vendor response not established. A vendor fix does not mean a deployment is fixed.

## Affected components
- Packagist facturascripts/facturascripts: affected <= 2025.81

## Suggested inspection (read-only)
- Packagist facturascripts/facturascripts: check the installed version with your package manager.

## Supported action
No complete vendor fix is recorded. Follow the primary source's mitigation guidance and check this record again before closing anything.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on facturascripts/facturascripts.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://github.com/advisories/GHSA-vf3q-frmr-vrr9 (GitHub-reviewed advisory GHSA-vf3q-frmr-vrr9 lists affected ranges: Packagist facturascripts/facturascripts >=0 <=2025.81)

Commands are suggestions: review each one before running it.