FacturaScripts, an open source accounting and invoicing software by NeoRazorX, has a vulnerability (CVE-2026-27891) in the Plugins::add() function where improper input validation of ZIP archive file paths allows a Zip Slip attack. The testZipFile function validates that the ZIP contains only one root folder but fails to sanitize individual file paths, allowing path traversal sequences (e.g., ../../) to escape the intended directory. An attacker can craft a ZIP file with a file named ValidPluginName/../../shell.php, bypassing the root folder check but causing the file to be extracted outside the plugin directory. This leads to arbitrary file write and remote code execution by overwriting PHP files. The vulnerability affects versions prior to 2026.1 and has a CVSS 3.1 score of 7.2 (high severity).

Successful exploitation allows an attacker with high privileges to perform arbitrary file writes outside the designated plugins directory, potentially overwriting critical PHP files. This can lead to remote code execution, compromising the confidentiality, integrity, and availability of the affected system. The vulnerability is rated high severity with a CVSS score of 7.2.

This vulnerability is fixed in FacturaScripts version 2026.1. Users should upgrade to version 2026.1 or later to remediate this issue. No official patch or temporary fix is indicated other than upgrading. Since this is not a cloud service, remediation depends on applying the vendor's fixed version.