# CVE-2026-27891: facturascripts RCE (High 7.2) 🐘 🐘 Packagist Not in CISA KEV HIGH severity # CVE-2026-27891 — facturascripts HIGH [Fix: NeoRazorX/facturascripts@2dda7c6](https://github.com/NeoRazorX/facturascripts/commit/2dda7c6f3b241fa84a0629166783720b882725fd) CVE-2026-27891 is a high-severity (CVSS 7.2) Improper Input Validation vulnerability in facturascripts/facturascripts. The records list no fixed version yet; check the vendor advisory below and apply the mitigations in the meantime. Remote Code Execution (RCE) via Zip Slip in Plugin Upload Mechanism Also known as[GHSA-3pgc-xqg9-cfr6](/vulnerability/GHSA-3pgc-xqg9-cfr6) Published May 18, 2026 Updated Oct 28, 2026 Affected 1 pkg Patched See advisory Exploits None indexed Exploitation data as of Nov 10, 2026 · OSV.dev, NVD, FIRST.org (EPSS) ## Exploitation Status ### Proof-of-concept exploit code exists - CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation. - A successful exploit gives an attacker total control of the affected component, not partial access. Exploitation and automatability from CISA’s SSVC triage for CVE-2026-27891. ## EPSS Exploitation Probability [via FIRST.org ↗](https://www.first.org/epss/) 0.5%probability of exploitation in next 30 days Lower Risk0.00% Lower risk than most CVEs45th percentile — riskier than 45% of all scored CVEsHighest risk 0.00%0.46%0.91%1.37%0.2%0.5%Jun 26Sep 26Nov 26 Probability of exploitation in the next 30 days, from [FIRST.org EPSS](https://www.first.org/epss/). ## How urgent is this, really ## Where this sits among everything scored ## Real-World Exposure 1 pkg affected 🐘`facturascripts/facturascripts` Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems. ## Description #### Summary A Critical vulnerability exists in the `Plugins::add()` function. The system fails to properly validate the file paths within uploaded ZIP archives. This allows an attacker to perform a Zip Slip attack, leading to Arbitrary File Write and Remote Code Execution (RCE) by overwriting sensitive .php files outside the designated plugins directory. #### Details The vulnerability is located in Plugins.php. While the `testZipFile` function attempts to validate that the ZIP contains only one root folder, it does not sanitize or validate the individual file paths within that folder. ``` // Vulnerable logic in Plugins.php for ($index = 0; $index < $zipFile->numFiles; $index++) { $data = $zipFile->statIndex($index); $path = explode('/', $data['name']); if (count($path) > 1) { $folders[$path[0]] = $path[0]; } } ``` An attacker can bypass this check by naming a file `ValidPluginName/../../shell.php`. The explode function will see ValidPluginName as the root folder, satisfying the `count($folders) != 1` check. However, during extraction, the `../../` sequence triggers a path traversal, allowing the file to be written anywhere the web server has permissions the root directory. #### PoC Prepare Malicious ZIP: Use a tool (like evilarc) or a script to create a ZIP file where one of the entries is named: `MyPlugin/../../rce.php` Inject Payload: Inside rce.php, put a simple shell: `` Upload: Navigate to the "Add Plugin" section in FacturaScripts and upload the malicious ZIP. Execution: Access the shell via [https://target.com/rce.php?cmd=whoami](https://target.com/rce.php?cmd=whoami). #### Impact Confidentiality: High (Attacker can read all database configs and files). Integrity: High (Attacker can modify any file on the server). Availability: High (Attacker can delete the entire installation). > [https://github.com/ZeroXJacks/CVEs/blob/main/2026/CVE-2026-27891.md](https://github.com/ZeroXJacks/CVEs/blob/main/2026/CVE-2026-27891.md) ## Affected Packages 1 total Ecosystem Package Vulnerable range Fix 🐘Packagist `facturascripts/facturascripts` all versions No fix ## Detection & mitigation playbook Open-source dependency 1. ### Detect Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for facturascripts/facturascripts, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version. 2. ### Remediation status The records we use list no patched version of facturascripts/facturascripts for CVE-2026-27891. Check the maintainer's advisory, and where your build allows, override or pin the dependency away from the vulnerable range. 3. ### Mitigate without a patch Treat uploaded files as untrusted until proven otherwise: validate the actual content type rather than the supplied extension, store uploads outside the web root on a volume mounted without execute permission, and rename them to server-generated identifiers so an attacker cannot choose the path a request will later resolve. ## Frequently Asked Questions \### Summary A Critical vulnerability exists in the \`Plugins::add()\` function. The system fails to properly validate the file paths within uploaded ZIP archives. This allows an attacker to perform a Zip Slip attack, leading to Arbitrary File Write and Remote Code Execution (RCE) by overwriting sensitive .php files outside the designated plugins directory. ### Details The vulnerability is located in Plugins.php. While the \`testZipFile\` function attempts to validate that the ZIP contains only one root folder, it does not sanitize or validate the individual file paths within that folder. \`\`\`js // O3 Security · Impact-Aware SCA ### Is CVE-2026-27891 in your dependencies? Find it across Packagist, including transitive dependencies. [Scan my dependencies](/book-demo) [How O3 SCA works](/impact-aware-sca)