CVE-2026-42879 - FacturaScripts - Authenticated Unrestricted File Upload via MIME Type Bypass
Summary
An authenticated unrestricted file upload vulnerability exists in FacturaScripts' product image upload functionality. An attacker with valid credentials can upload a PHP file disguised as a GIF image (using a GIF89a header), bypassing MIME type validation. The file is stored with its original extension, including executable extensions such as .php.
The validation only checks if MIME type contains "image/"
This can be bypassed by prepending GIF89a magic bytes to a PHP file
The system incorrectly identifies the file as image/gif
The file is saved with a .php extension in a web-accessible directory
File Storage Behavior
Uploaded files are stored in:
/MyFiles/YYYY/MM/X.php
Where X is an auto-incrementing ID. This allows direct remote execution:
http://target/MyFiles/2026/03/2.php?cmd=id
Impact
Successful exploitation:
An attacker may upload files with executable extensions (e.g. .php) to the server, which depending on server configuration could lead to further exploitation.
Validate file extension — reject any upload where the filename ends in .php, .phtml, .phar, or other executable extensions, regardless of MIME type
Re-generate filenames on the server — never use getClientOriginalName(); assign a safe UUID-based name with a validated extension
Store uploads outside the webroot — serve files through a controller that streams content, preventing direct URL execution
Use a file type library — validate actual file content (magic bytes + extension + MIME type) with a library like fileinfo rather than trusting client-supplied MIME