CVE-2026-40521

Name of the Vulnerable Software and Affected Versions FrontAccounting versions prior to 2.4.20

Description A path traversal issue exists in the attachment upload handler. Authenticated attackers can execute arbitrary code by uploading files using traversal sequences in the unique name parameter. By providing sequences such as ../../../shell.php, an attacker can write files outside the designated attachments directory and into the web root. Since the system lacks extension validation for uploaded PHP files, this allows for remote code execution as the web server user.

Recommendations Update to version 2.4.20 or later.