An authenticated administrator-level vulnerability in FacturaScripts allows for arbitrary file uploads, posing a critical risk of full system compromise.

The application fails to properly validate input and restricts file uploads, allowing an authenticated user with administrative privileges to upload and execute malicious files on the host server.

Successful exploitation allows an attacker with administrative access to achieve remote code execution, potentially leading to total system compromise, data exfiltration, or complete disruption of accounting services. With a CVSS score of 7.2, this vulnerability represents a significant risk to the integrity and confidentiality of sensitive financial data.

Immediate Action: Update FacturaScripts to version 2026.1 or later immediately to address the underlying input validation and file upload flaws.

Proactive Monitoring: Review web server and application logs for suspicious file uploads or access to non-standard executable files within the upload directories.

Compensating Controls: Implement strict file type validation at the Web Application Firewall (WAF) level and restrict administrative access to the application to trusted, internal IP addresses only.

Public Exploit Available: Unknown.

Given the potential for remote code execution, organizations should prioritize patching FacturaScripts to version 2026.1. While the vulnerability requires administrative authentication, the impact of a breach in an accounting system is severe and warrants immediate remediation.