An unrestricted file upload vulnerability exists in MATCHA INVOICE versions 2.6.6 and earlier, allowing an administrator to upload a file with a dangerous type. Once uploaded, the attacker can place malicious files on the server, potentially leading to execution of arbitrary code. This flaw is categorized as CWE‑434 and directly threatens confidentiality, integrity, and availability.

ICZ Corporation’s MATCHA INVOICE is affected, specifically all releases up to and including version 2.6.6. Systems running the product in those versions are at risk whenever an administrator has the ability to upload files.

With a CVSS score of 5.1, the vulnerability represents moderate severity. No EPSS score is reported and the flaw is not listed in CISA's KEV catalog, suggesting a lower likelihood of current exploitation. The likely attack vector hinges on an attacker obtaining administrative access or leveraging an administrative user having file‑upload capabilities. Once the file is uploaded, execution can occur without additional privilege escalation.