GHSA-HGJX-R89M-M7V4: GHSA-HGJX-R89M-M7V4: Remote Code Execution via Path Traversal in FacturaScripts

GHSA-HGJX-R89M-M7V4: Remote Code Execution via Path Traversal in FacturaScripts

Vulnerability ID: GHSA-HGJX-R89M-M7V4
CVSS Score: 9.9
Published: 2026-07-14

FacturaScripts is an open-source PHP-based enterprise resource planning (ERP) and billing software. A critical path traversal vulnerability in the file-handling logic allows authenticated attackers with file upload permissions to write arbitrary files to any location on the system writable by the web server user. By writing custom server configuration files (.htaccess) to directories excluded from default rewrite rules, attackers can map allowed file types (like .png) to the PHP interpreter, leading to full remote code execution.

TL;DR

An authenticated path traversal vulnerability in FacturaScripts allows arbitrary file uploads and server configuration overrides, resulting in unauthenticated remote code execution via public directories.

---

⚠️ Exploit Status: POC

Technical Details

• CWE ID: CWE-22, CWE-434
• Attack Vector: Network (AV:N)
• CVSS v3.1 Score: 9.9 (Critical)
• Exploit Status: Proof of Concept (PoC) documented
• Impact: Remote Code Execution (RCE)

Affected Systems

• FacturaScripts ERP
• FacturaScripts billing software

Mitigation Strategies

• Apply security patch introducing basename() to UploadedFile file paths
• Implement a strict validation allowlist of MIME types and extensions
• Disable dynamic execution of scripts inside public writable folders
• Utilize realpath() to enforce safe path boundaries on the host file system

Remediation Steps:

1. Apply the patch modifying Core/UploadedFile.php to sanitize $destinyName using basename()
2. Update server configurations (Apache/Nginx) to explicitly block PHP execution within the Dinamic/Assets/ and MyFiles/ directories
3. Conduct a review of file upload endpoints to verify permissions and restrict access to authenticated, authorized users only

References

• GitHub Security Advisory GHSA-hgjx-r89m-m7v4
• FacturaScripts Repository Advisory
• FacturaScripts Repository

---

Read the full report for GHSA-HGJX-R89M-M7V4 on our website for more details including interactive diagrams and full exploit analysis.