CVE-2026-42879 is a code injection vulnerability in NeoRazorX's FacturaScripts accounting software (version 2025.81 and earlier). It arises from an authenticated unrestricted file upload flaw in the product image upload functionality. The vulnerability allows an attacker with valid credentials to upload a PHP file disguised as a GIF image by manipulating the file header to GIF89a, bypassing MIME type checks. The file is stored with its original extension, including executable extensions like .php, enabling execution of arbitrary code on the server. The issue is located in the addImageAction() method within Core/Lib/ExtendedController/ProductImagesTrait.php. No official patch or remediation level has been provided yet.

An attacker who is authenticated can upload malicious PHP files disguised as images, potentially leading to arbitrary code execution on the server. This could compromise the confidentiality, integrity, and availability of the affected system. The CVSS vector indicates network attack vector, low attack complexity, required privileges, no user interaction, and impacts on confidentiality, integrity, and availability, all at low levels.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated user permissions to prevent unauthorized file uploads and consider implementing additional server-side validation to verify file types beyond MIME headers. Monitor for suspicious file uploads and remove any files with executable extensions uploaded through the image upload functionality.