{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"2025.71"}],"component":"facturascripts/facturascripts","cve_ids":["CVE-2026-27891"],"ecosystem":"Packagist","epss":0.00522,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-3pgc-xqg9-cfr6","id":"tcs_01M5KET6DXYXP0XE5GMDBBR3KM","modified_at":"2026-05-07T19:56:27.875430Z","published_at":"2026-05-07T19:32:14Z","references":["https://osv.dev/vulnerability/GHSA-3pgc-xqg9-cfr6","https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-3pgc-xqg9-cfr6","https://github.com/NeoRazorX/facturascripts"],"severity":{"label":"high","score":7.2},"sources":[{"source":"osv","source_id":"GHSA-3pgc-xqg9-cfr6","url":"https://osv.dev/vulnerability/GHSA-3pgc-xqg9-cfr6"}],"summary":"FacturaScripts Vulnerable to Remote Code Execution (RCE) via Zip Slip in Plugin Upload Mechanism"}