CVE-2026-77526: FacturaScripts: Path traversal in UploadedFile::move() via getClientOriginalName() — arbitrary file write outside MyFiles/ leading to RCE

Should you act?

Critical, preconditions apply

Severe if exploited, but exploitation needs conditions that may not apply to you. This signal is computed from CISA KEV, EPSS and CVSS data; it is not an editorial verdict.

• No confirmed exploitation. It is not in CISA’s KEV catalog. That can change quickly after a public write-up; re-check if you are affected.
• Needs an account (low (any account)). Exposure depends on who can log in.
• Only applies if your dependency tree includes facturascripts/facturascripts (Composer (PHP)) >= 2025, <= 2026.2, fixed in 2026.3. Check your lockfile, including transitive dependencies.

What it is

From the GitHub advisory

Summary

FacturaScripts\Core\UploadedFile::move($destiny, $destinyName) concatenates $destiny and $destinyName without normalizing the resulting path. Every caller in the codebase passes UploadedFile::getClientOriginalName() — the unsanitized client-supplied filename — as $destinyName, so an authenticated user submitting a filename containing ../ segments can write the uploaded content to any directory writable by the web-server user, escaping the intended MyFiles/ location.

Because the shipped htaccess-sample (the documented production Apache configuration) excludes Dinamic/Assets/ and nodemodules/ from the index.php rewrite, files written into those directories are served directly by Apache. Combined with .htaccess not being in BLOCKEDEXTENSIONS, the primitive escalates from arbitrary file write to remote code execution.

Vulnerable Code

Core/UploadedFile.php:

Weakness type: CWE-22, CWE-434.

Product: facturascripts/facturascripts (Composer (PHP)) · Published: 2026-07-14

Affected and fixed versions

Severity scores

• Attack vector: network (remotely reachable)
• Attack complexity: low
• Privileges required: low (any account)
• User interaction: none
• Scope: changed (can affect other components)

CVSS measures how bad a flaw is if exploited, not how likely exploitation is. Read it next to the exploitation data below.

Exploitation and urgency

• CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).

Timeline

• 2026-07-14 — GitHub-reviewed advisory GHSA-hgjx-r89m-m7v4 published (critical)

Sources and references

Original sources first. Version and fix details should always be confirmed against the vendor or project advisory.

Vulnerability records

1. GitHub Advisory GHSA-hgjx-r89m-m7v4 github.com
2. CVE.org record CVE-2026-77526 cve.org
3. NVD entry CVE-2026-77526 nvd.nist.gov

Other references from the CVE record and advisory

1. github.com github.com

Critical Composer (PHP) advisories · Today’s Security Digest