CVE-2026-57863: Crater Invoice 6.0.6 Path Traversal RCE via update/unzip endpoint
Crater Invoice through 6.0.6 contains a path traversal vulnerability in the self-update API that allows authenticated company owners to write arbitrary files outside the intended extraction directory by supplying crafted ZIP archives with ../ sequences to the unzip endpoint. Attackers can exploit unsanitized ZIP entry names passed to PHP's ZipArchive::extractTo() to write arbitrary PHP files into the web-accessible public directory and achieve remote code execution on the server.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated as a company owner. The vulnerable functionality is the self-update API's unzip endpoint.
What does exploitation require?
The attacker needs to supply a crafted ZIP archive containing entry names with ../ sequences. Those entries can cause files to be written outside the intended extraction directory.
What is the likely impact after successful exploitation?
An authenticated company owner can write arbitrary files, including PHP files, into the web-accessible public directory. This can lead to remote code execution on the server.