FacturaScripts: Unauthenticated Path Traversal in Static File Controllers Reads Private MyFiles Documents

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS

7.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

No dated EPSS signal available.

As published by the source; long descriptions are shortened.

Summary The static file controllers in FacturaScripts decide whether a request is authorized by looking at the URL string instead of the canonical filesystem path. A request that starts with an allow-listed folder name but contains a ../ segment in the middle ends up serving a file from a different directory than the one the URL pretended to point at. This makes any file inside the FacturaScripts installation readable without authentication as long as the file's extension is on the controllers' allow-list (pdf, xlsx, docx, csv, sql, zip, xml, json, xsig, etc.). In practice this leaks the documents the application is specifically designed to protect: customer invoices, supplier invoices, document attachments and database backups stored under MyFiles/Private/ and other non-public subfolders. The two vulnerable controllers are Core/Controller/Files.php (used by the /Plugins/, /Core/Assets/, /Dinamic/Assets/ and /nodemodules/ routes) and Core/Controller/Myfiles.php (used by /MyFiles/).…

Published by the source

14 Jul 2026, 17:12 UTC

Last modified by the source

14 Jul 2026, 17:12 UTC

Source last checked

26 Oct 2026, 14:50 UTC

1. Revision 1 · created · 26 Oct 2026

   Published from ghsa record GHSA-cv65-7cg8-r623

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: CVE-2026-45693

Advisory: FacturaScripts: Unauthenticated Path Traversal in Static File Controllers Reads Private MyFiles Documents
IDs: CVE-2026-45693, GHSA-cv65-7cg8-r623
Record: https://patchnext.com/advisories/cve-2026-45693 (revision 1, source checked 26 Oct 2026, 14:50 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: High (CVSS 7.5)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Vendor response not established. A vendor fix does not mean a deployment is fixed.

## Affected components
- Packagist facturascripts/facturascripts: affected <= 2026.2

## Suggested inspection (read-only)
- Packagist facturascripts/facturascripts: check the installed version with your package manager.

## Supported action
No complete vendor fix is recorded. Follow the primary source's mitigation guidance and check this record again before closing anything.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on facturascripts/facturascripts.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://github.com/advisories/GHSA-cv65-7cg8-r623 (GitHub-reviewed advisory GHSA-cv65-7cg8-r623 lists affected ranges: Packagist facturascripts/facturascripts >=0 <=2026.2)

Commands are suggestions: review each one before running it.