Threats tagged 'ghsa-hgjx-r89m-m7v4'

FacturaScripts contains a critical path traversal vulnerability in the UploadedFile::move() method, allowing authenticated users to write files outside the intended upload directory by supplying filenames with '../' segments. This flaw arises because the code concatenates the destination path and the unsanitized client filename without normalization. The default Apache configuration serves files directly from certain directories (e.g., Dinamic/Assets/), enabling an attacker to upload malicious files such as .htaccess overrides and PHP payloads, resulting in remote code execution.