OpenSourcePOS version 3.4.1 contains a Local File Inclusion vulnerability in the Sales.php::getInvoice() function, which allows an attacker to read arbitrary files on the web server by manipulating the Invoice Type configuration. The vulnerability is a direct file inclusion flaw (CWE-434) and can be chained with the existing file upload functionality to achieve remote code execution. The impact extends beyond the web server to potentially allow full compromise of the application and underlying hosting environment.

OpenSourcePOS, open_source_point_of_sale, version 3.4.1. No additional vendor or product variants are listed in the CNA data. The vulnerability is present in this specific release only.

The CVSS score of 8.8 classifies this flaw as high severity. The EPSS score of less than 1% indicates a very low probability of exploitation at the time of analysis, and the vulnerability is not currently listed in CISA’s KEV catalog. The likely attack path involves an attacker with web access who can influence the Invoice Type configuration, followed by exploitation of the file upload capability to achieve code execution. The risk is significant if the system is publicly exposed and the vulnerable configuration is accessible.