CVE-2026-57863

Name of the Vulnerable Software and Affected Versions Crater Invoice versions prior to 6.0.7

Description A path traversal issue exists in the self-update API. Authenticated company owners can write arbitrary files outside the intended extraction directory by providing crafted ZIP archives containing ../ sequences to the /unzip endpoint. This occurs because unsanitized ZIP entry names are passed to the ZipArchive::extractTo() function, allowing attackers to place arbitrary PHP files into the web-accessible public directory and achieve remote code execution (RCE), which is the ability to execute arbitrary commands on the server.

Recommendations Update Crater Invoice to version 6.0.7 or later. Restrict access to the /unzip endpoint to minimize the risk of exploitation.