CVE-2026-42879 is an authenticated unrestricted file upload vulnerability in NeoRazorX's FacturaScripts accounting software versions 2025.81 and earlier. The flaw exists in the product image upload feature, specifically in the addImageAction() method, where MIME type validation can be bypassed by uploading a PHP file with a GIF89a header. The file is stored with its original extension, including executable extensions like .php, enabling code injection (CWE-94) and improper file upload control (CWE-434). This allows an authenticated attacker to potentially execute arbitrary code on the server.

An attacker with valid credentials can upload malicious PHP files disguised as images, potentially leading to remote code execution or unauthorized actions on the affected system. The vulnerability impacts confidentiality, integrity, and availability as indicated by the CVSS vector (C:L/I:L/A:L). There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is currently documented, users should restrict access to the upload functionality to trusted users only and monitor for suspicious uploads. Applying strict server-side validation on file types and extensions and disabling execution permissions on upload directories are recommended interim mitigations until an official fix is released.