{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"2025","last_affected":"2026.2"}],"component":"facturascripts/facturascripts","cve_ids":[],"ecosystem":"Packagist","exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-hgjx-r89m-m7v4","id":"tcs_01M5KF3MRJH0X5B0N2WRM0A01B","modified_at":"2026-07-14T21:00:58.255347378Z","published_at":"2026-07-14T20:52:00Z","references":["https://osv.dev/vulnerability/GHSA-hgjx-r89m-m7v4","https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-hgjx-r89m-m7v4","https://github.com/NeoRazorX/facturascripts"],"severity":{"label":"critical","score":9.9},"sources":[{"source":"osv","source_id":"GHSA-hgjx-r89m-m7v4","url":"https://osv.dev/vulnerability/GHSA-hgjx-r89m-m7v4"}],"summary":"FacturaScripts: Path traversal in UploadedFile::move() via getClientOriginalName() — arbitrary file write outside MyFiles/ leading to RCE"}