The vulnerability CVE-2026-33273 affects MATCHA INVOICE versions 2.6.6 and earlier by permitting unrestricted upload of files with dangerous types. This flaw enables an administrator user to create arbitrary files on the server, which may lead to execution of arbitrary code. The CVSS 3.0 vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, and impacts on confidentiality, integrity, and availability at a low to medium level. No official remediation or patch information is currently available from the vendor or advisories.

If exploited, this vulnerability allows an administrator to upload malicious files that could result in arbitrary code execution on the server hosting MATCHA INVOICE. This could compromise the confidentiality, integrity, and availability of the affected system. However, exploitation requires administrator privileges, limiting the attack surface. There are no known active exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrator access to trusted personnel only and monitor for suspicious file uploads. Avoid granting unnecessary administrator privileges to reduce risk.