CVE-2026-42879 Details

A vulnerability allowing authenticated users to upload files with executable extensions has been identified in FacturaScripts accounting and invoicing software, versions through 2025.81. The issue arises in the product image upload feature, where MIME type validation can be bypassed. Attackers can upload PHP files disguised as GIF images by exploiting the validation process, which only checks for the presence of 'image/' in the MIME type. The uploaded files are stored with their original extensions in a web-accessible directory, potentially leading to remote code execution.

Users are advised to implement proper file validation to reject uploads with executable extensions, regenerate filenames to ensure safety, store uploads outside of the webroot, and use a file type library to validate actual file content.