CVE-2026-104905

FacturaScripts before version 2026.7 contains a PHP object injection vulnerability in WidgetSelect::processFormData() that allows authenticated attackers to trigger unserialize() on raw POST data without an allowed_classes filter for multiple-select fields. Attackers can submit a serialized XLSXWriter object as the field value to invoke its __destruct() method, deleting arbitrary attacker-specified files such as config.php or backup data, resulting in denial of service and potential application reinstall hijack.

CVSS 4.0

6.1CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

8.1CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

EPSS

0.5% chance of exploitation in the next 30 days; higher than 42% of CVEs (scores of 2026-10-25)

CWE

CWE-502

Published

2026-10-05

Modified

2026-10-06

Record from

the NVD, synced 2026-10-19

References

• https://github.com/NeoRazorX/facturascripts/releases/tag/v2026.7
• https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-p89j-gj6f-fh6g
• https://www.vulncheck.com/advisories/facturascripts-php-object-injection-via-widgetselect
• https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-p89j-gj6f-fh6g

Check your stackJSON