FacturaScripts, an open‑source accounting and invoicing platform, contains an authenticated, unrestricted file‑upload flaw in its product image upload. By uploading a PHP script that starts with a GIF89a header, an attacker can bypass the MIME‑type check and store the file with a .php extension. This allows execution of arbitrary PHP code on the server, resulting in full remote code execution by any user who can authenticate to the application.

NeoRazorX FacturaScripts versions 2025.81 and earlier are affected. The vulnerability resides in the addImageAction() method of Core/Lib/ExtendedController/ProductImagesTrait.php, which processes uploaded product images.

With a CVSS score of 6.3, the flaw is considered moderate severity. Exploitation requires valid credentials, making the attack vector authenticated remote, but the benefit of executing arbitrary code is significant. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. Attackers who can authenticate to the system can upload a crafted GIF that contains PHP code, thereby taking control of the application and potentially surrounding infrastructure.