{"id":"CVE-2026-27891","aliases":["GHSA-3pgc-xqg9-cfr6"],"url":"https://o3.security/vulnerability/CVE-2026-27891","summary":"Remote Code Execution (RCE) via Zip Slip in Plugin Upload Mechanism","details":"### Summary\nA Critical vulnerability exists in the `Plugins::add()` function. The system fails to properly validate the file paths within uploaded ZIP archives. This allows an attacker to perform a Zip Slip attack, leading to Arbitrary File Write and Remote Code Execution (RCE) by overwriting sensitive .php files outside the designated plugins directory.\n\n### Details\nThe vulnerability is located in Plugins.php. While the `testZipFile` function attempts to validate that the ZIP contains only one root folder, it does not sanitize or validate the individual file paths within that folder.\n```js\n// Vulnerable logic in Plugins.php\nfor ($index = 0; $index < $zipFile->numFiles; $index++) {\n    $data = $zipFile->statIndex($index);\n    $path = explode('/', $data['name']);\n    if (count($path) > 1) {\n        $folders[$path[0]] = $path[0];\n    }\n} \n```\nAn attacker can bypass this check by naming a file `ValidPluginName/../../shell.php`. The explode function will see ValidPluginName as the root folder, satisfying the `count($folders) != 1` check. However, during extraction, the `../../` sequence triggers a path traversal, allowing the file to be written anywhere the web server has permissions the root directory.\n### PoC\nPrepare Malicious ZIP: Use a tool (like evilarc) or a script to create a ZIP file where one of the entries is named: `MyPlugin/../../rce.php`\nInject Payload: Inside rce.php, put a simple shell: \n`<?php system($_GET['cmd']); ?>`\nUpload: Navigate to the \"Add Plugin\" section in FacturaScripts and upload the malicious ZIP.\nExecution: Access the shell via https://target.com/rce.php?cmd=whoami.\n\n### Impact\nConfidentiality: High (Attacker can read all database configs and files).\nIntegrity: High (Attacker can modify any file on the server).\nAvailability: High (Attacker can delete the entire installation).\n> https://github.com/ZeroXJacks/CVEs/blob/main/2026/CVE-2026-27891.md","published":"2026-05-18T21:16:15.240Z","modified":"2026-08-12T03:51:08.229514770Z","cvss":{"score":7.2,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"},"epss":{"score":0.00522,"percentile":0.43034,"asOf":"2026-09-16"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"facturascripts/facturascripts","fixedVersion":null}],"fix":{"url":"https://github.com/NeoRazorX/facturascripts/commit/2dda7c6f3b241fa84a0629166783720b882725fd","label":"NeoRazorX/facturascripts@2dda7c6"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27891.json"},{"type":"ADVISORY","url":"https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-3pgc-xqg9-cfr6"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27891"},{"type":"FIX","url":"https://github.com/NeoRazorX/facturascripts/commit/2dda7c6f3b241fa84a0629166783720b882725fd"},{"type":"PACKAGE","url":"https://github.com/NeoRazorX/facturascripts"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:08.229514770Z"}}