CVE-2026-104905: FacturaScripts < 2026.7 PHP Object Injection via WidgetSelect
FacturaScripts before version 2026.7 contains a PHP object injection vulnerability in WidgetSelect::processFormData() that allows authenticated attackers to trigger unserialize() on raw POST data without an allowedclasses filter for multiple-select fields. Attackers can submit a serialized XLSXWriter object as the field value to invoke its destruct() method, deleting arbitrary attacker-specified files such as config.php or backup data, resulting in denial of service and potential application reinstall hijack.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FacturaScriptsto a version that resolves this vulnerability.Fixed in 2026.7
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker must be authenticated to FacturaScripts and able to submit POST data to a form using a multiple-select WidgetSelect field. No user interaction is required.
Are default deployments affected?
The available information identifies affected versions as FacturaScripts before 2026.7, but does not state whether multiple-select WidgetSelect fields are present or reachable in every default deployment.
What is the likely impact of exploitation?
An attacker can cause deletion of attacker-specified files, including config.php or backup data, through the XLSXWriter object's destructor. This can cause denial of service and may enable application reinstall hijack if configuration is deleted.
How can I tell whether an instance is affected?
Check whether the installed FacturaScripts version is earlier than 2026.7. The vulnerable code path is associated with WidgetSelect::processFormData() handling raw POST data for multiple-select fields.