A critical path traversal vulnerability in FrontAccounting allows authenticated attackers to achieve remote code execution on the underlying server.

This vulnerability exists in the attachment upload handler, where the application fails to properly sanitize the unique_name parameter. By supplying directory traversal sequences, an authenticated attacker can write arbitrary PHP files to the web root and execute them as the web server user.

With a CVSS score of 8.8, this vulnerability poses a severe risk to organizational infrastructure. Successful exploitation allows an attacker to gain full control over the application server, leading to potential data exfiltration, total system compromise, and significant operational downtime.

Immediate Action: Upgrade FrontAccounting to version 2.4.20 or later to apply the necessary path validation fixes.

Proactive Monitoring: Monitor server logs for suspicious file upload activity or requests containing directory traversal patterns (e.g., ../) in the attachments directory.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block directory traversal sequences and restrict file uploads to expected types/extensions.

Public Exploit Available: true

The availability of public exploit code significantly increases the risk of active targeting. Organizations running FrontAccounting must prioritize upgrading to version 2.4.20 immediately to neutralize this threat and prevent unauthorized code execution.