Changes.Watch~ upgrade verdicts ~
Free digest
Research1 in 10 popular npm releases needed a hotfix

critical vulnerability

FacturaScripts: Path traversal in UploadedFile::move() via getClientOriginalName() — arbitrary file write outside MyFiles/ leading to RCE

Fix availableCritical · CVSS 9.9

Published Jul 14, 2026 · updated Nov 2, 2026

What to do

  1. Upgrade to a fixed version: facturascripts/facturascripts 2026.3.
  2. Redeploy and restart long-running processes so they load the fixed code.

Affected packages

Composerfacturascripts/facturascripts

Vulnerable versions
>= 2025, <= 2026.2
Fixed in
2026.3

Check your project: composer show facturascripts/facturascripts

Sources

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') · CWE-434 Unrestricted Upload of File with Dangerous Type

← All critical vulnerabilities