CVE-2026-104905

Name of the Vulnerable Software and Affected Versions FacturaScripts versions prior to 2026.7

Description An authenticated attacker can exploit a PHP object injection issue within the processFormData() function of WidgetSelect. This occurs because the application performs unserialize() on raw POST data for multiple-select fields without applying an allowed classes filter. By submitting a serialized XLSXWriter object as a field value, an attacker can trigger the destruct() method to delete arbitrary files, such as config.php or backup data. This can lead to a denial of service or a potential application reinstall hijack.

Recommendations Update FacturaScripts to version 2026.7 or later.