{"items":[{"id":"NVI-00006091","kind":"vulnerability","title":"FacturaScripts: Unauthenticated Path Traversal in Static File Controllers Reads Private MyFiles Documents","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-cv65-7cg8-r623","CVE-2026-45693"],"plain_summary":"OSV carries this publisher advisory for facturascripts/facturascripts. This is an aggregated source copy; consult the original publisher and compare update dates.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-a70730132f85565721e0c9411c8f3cf1"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-a70730132f85565721e0c9411c8f3cf1","url":"https://github.com/advisories/GHSA-cv65-7cg8-r623","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-cv65-7cg8-r623","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:42:10.703Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-a70730132f85565721e0c9411c8f3cf1"],"technology":"facturascripts/facturascripts","known_exclusions":[],"conditions_summary":"### Summary\n\nThe static file controllers in FacturaScripts decide whether a request is authorized by looking at the URL string instead of the canonical filesystem path. A request that starts with an allow-listed folder name but contains a `../` segment in the middle ends up serving a file from a different directory than the one the URL pretended to point at. This makes any file inside the FacturaScripts installation readable without authentication as long as the file's extension is on the controllers' allow-list (`pdf`, `xlsx`, `docx`, `csv`, `sql`, `zip`, `xml`, `json`, `xsig`, etc.). In practice this leaks the documents the application is specifically designed to protect: customer invoices, supplier invoices, document attachments and database backups stored under `MyFiles/Private/` and other non-public subfolders.\n\nThe two vulnerable controllers are `Core/Controller/Files.php` (used by the `/Plugins/*`, `/Core/Assets/*`, `/Dinamic/Assets/*` and `/node_modules/*` routes) and `Core/Controller/Myfiles.php` (used by `/MyFiles/*`). Both share the same root cause: a `strpos()` / `substr()` prefix check on the raw URL is treated as proof that the resolved file lives inside an authorized","public_affected_ranges":["ECOSYSTEM: introduced 0; last_affected 2026.2"]}],"null_published_at":"2026-10-31T22:13:05.858Z","source_updated_at":"2026-07-14T17:41:43.025Z","source_disclosed_at":"2026-07-14T17:12:56.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T21:42:10.703Z"}],"next_cursor":null,"snapshot_revision":"42594"}