Packagist/facturascripts/facturascripts: critical 9.9

FacturaScripts: Path traversal in UploadedFile::move() via getClientOriginalName() — arbitrary file write outside MyFiles/ leading to RCE

Action: No fix published. Pin and monitor.

Affected

Fixed versions

No fixed version in the source.

Sources

• osv: GHSA-hgjx-r89m-m7v4
• https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-hgjx-r89m-m7v4
• https://github.com/NeoRazorX/facturascripts

published 2026-07-14T20:52:00Z · modified 2026-07-14T21:00:58.255347378Z · JSON