FacturaScripts before version 2026.7 contains a PHP object injection vulnerability in WidgetSelect::processFormData(). The method calls unserialize() on raw POST data for multiple‑select fields without applying an allowed_classes filter. An authenticated attacker can submit a serialized instance of XLSXWriter, causing its __destruct() method to execute and delete arbitrary files such as config.php or backup archives. This can lead to denial of service and, by removing essential files, enable a hijacked application reinstall.

The impacted vendor is NeoRazorX and the affected product is FacturaScripts. Any deployment of FacturaScripts released before version 2026.7 is vulnerable and should be verified and updated.

The CVSS score is 6.1, indicating medium severity. The EPSS score is not available and the vulnerability is not listed in CISA KEV, suggesting a lower overall threat to the general population. Exploitation requires authenticated access and the privilege to submit POST data to the WidgetSelect component; once achieved, the attacker can delete critical application files, causing service interruption and potential hijack of the reinstall process.