CVE-2026-57863 Crater Invoice 6.0.6 Path Traversal RCE via update/unzip endpoint
Authenticated company owners can achieve remote code execution by uploading crafted ZIP archives with path traversal sequences to the self-update endpoint.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-57863?
CVE-2026-57863 is a high-severity path traversal vulnerability in crater-invoice-inc crater, published on 25 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Crater Invoice through 6.0.6 contains a path traversal vulnerability in the self-update API that allows authenticated company owners to write arbitrary files outside the intended extraction directory by supplying crafted ZIP archives with ../ sequences to the unzip endpoint. Attackers can exploit unsanitized ZIP entry names passed to PHP's ZipArchive::extractTo() to write arbitrary PHP files into the web-accessible public directory and achieve remote code execution on the server.
Weakness: CWE-22
Which versions are affected by CVE-2026-57863?
How do I fix CVE-2026-57863?
No fix has been published for CVE-2026-57863 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-57863 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-57863 exists.
Sources
Also known as GHSA-227x-v64x-3fq7.