A path traversal vulnerability in Crater Invoice allows authenticated users to achieve remote code execution by uploading crafted ZIP archives.

The self-update API fails to sanitize ZIP entry names, allowing an authenticated company owner to use path traversal sequences (../) to write files outside the intended directory. This permits the placement of arbitrary PHP code into the web root, facilitating remote code execution.

Successful exploitation results in full server-level access, allowing attackers to exfiltrate sensitive financial data, modify application records, or pivot to other network resources. With a CVSS score of 8.8, this vulnerability poses a critical risk to the confidentiality and integrity of the entire accounting platform.

Immediate Action: Check the vendor portal for available patches and apply them immediately, or disable the self-update functionality until a fix is deployed.

Proactive Monitoring: Inspect the web root directory for unauthorized PHP files and monitor file system activity for unexpected write operations originating from the update process.

Compensating Controls: Utilize a Web Application Firewall (WAF) to inspect incoming ZIP archives and block requests containing path traversal sequences or attempts to access restricted directories.

Public Exploit Available: Yes, a published PoC exists, attributed to the VulnCheck advisory and the associated GitHub gist.

Due to the availability of a public proof-of-concept and the high impact of remote code execution, this vulnerability represents an immediate threat. Administrators must act quickly to restrict access to the update endpoint and apply the latest security updates provided by the vendor.