CVE-2026-42878 FacturaScripts: Unauthenticated phpinfo() Disclosure via Installer Endpoint in FacturaScripts
Unauthenticated attackers can access phpinfo() on fresh FacturaScripts deployments, exposing sensitive server configuration and credentials.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-42878?
CVE-2026-42878 is a medium-severity vulnerability in NeoRazorX facturascripts, published on 27 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
FacturaScripts is an open source accounting and invoicing software. Prior to v2026, an unauthenticated information disclosure vulnerability in the Installer controller allows any remote attacker to trigger phpinfo() on a fresh FacturaScripts deployment by requesting /?phpinfo=TRUE, exposing full PHP configuration, server environment variables (including any database credentials, API keys, or application secrets set as env vars), filesystem paths, and loaded extensions without being authenticated. This vulnerability is fixed in v2026.
Weakness: CWE-200
Which versions are affected by CVE-2026-42878?
2 open source packages ship an affected version, including facturascripts/facturascripts.
| Package | Affected | Fixed in |
|---|---|---|
facturascripts/facturascripts Packagist | From 2026 to 2026.1 | None |
facturascripts/facturascripts Packagist | From 2026 to 2026.1 | None |
How do I fix CVE-2026-42878?
No fix has been published for CVE-2026-42878 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-42878 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-42878 exists.
Public exploit code: 1 Nuclei template.
Sources
Also known as GHSA-vrxf-vrc4-22p7.