{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "facturascripts/facturascripts"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2026"
            },
            {
              "last_affected": "2026.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-42878"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-07T19:43:24Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\nAn unauthenticated information disclosure vulnerability in the Installer controller allows any remote attacker to trigger phpinfo() on a fresh FacturaScripts deployment by requesting /?phpinfo=TRUE, exposing full PHP configuration, server environment variables (including any database credentials, API keys, or application secrets set as env vars), filesystem paths, and loaded extensions without being authenticated.\n\n### Details\nThe phpinfo() debug endpoint was intentionally added in commit 8c31c106  (\"Added phpinfo option to the installer\") on February 27, 2018, and has remained in the codebase for over 8 years across multiple major versions.\n\nThe feature appears to have been added as a convenience tool to help users diagnose PHP configuration during installation. However, it exposes sensitive server information to any unauthenticated attacker who knows the parameter.\n\nVulnerable code (Core/Controller/Installer.php ~line 115):\n\n    if (\u0027TRUE\u0027 === $this-\u003erequest-\u003equery(\u0027phpinfo\u0027, \u0027\u0027)) {\n        phpinfo();\n        return;\n    }\n\nThis vulnerability is of the same class as CVE-2025-34081 (CONPROSYS HMI System unauthenticated phpinfo() exposure), which received a CVE assignment.\n\nIntroduced: commit 8c31c1060581ad6ad591c7689da3a8df8a29f486 (Feb 27 2018)\nStill present: v2026-39-g262e79208 (confirmed April 2026)\n\n### PoC\nPrerequisites: Fresh FacturaScripts deployment where installation has not yet been completed (config.php does not contain db_name).\n\nStep 1 \u2014 Clone and serve the application:\n    git clone https://github.com/NeoRazorX/facturascripts\n    cd facturascripts\n    php -S localhost:8000\n\nStep 2 \u2014 Send the following unauthenticated GET request:\n    GET /?phpinfo=TRUE HTTP/1.1\n    Host: localhost:8000\n\nStep 3 \u2014 Observe full phpinfo() output returned (20+ pages) containing:\n    - Complete PHP configuration\n    - All server environment variables\n    - Filesystem paths\n    - Loaded extensions and versions\n    - HTTP request headers\n\nNo credentials, cookies, or prior interaction required.\n\nTested on: PHP 8.1.34, macOS, fresh clone with no configuration applied.\nProof of concept screenshot/PDF available.\n\n### Impact\nVulnerability type: Unauthenticated Information Disclosure (CWE-200)\n\nAny unauthenticated remote attacker who can reach a freshly deployed FacturaScripts instance before installation is completed can retrieve the full PHP environment. On production deployments this includes:\n\n  - Database credentials (DB_PASSWORD, DB_USER) if set as environment variables\n  - Application secrets (APP_KEY, JWT secrets) if set as environment variables  \n  - Cloud provider credentials (AWS_SECRET_ACCESS_KEY, etc.) if present\n  - Full server filesystem paths enabling targeted path traversal attempts\n  - Exact PHP version and loaded extensions enabling version-specific attacks\n  - All HTTP headers revealing internal infrastructure details\n  - Database connection configuration (mysqli default socket, PDO drivers)\n  - Exact PHP version enabling version-specific CVE targeting (PHP 8.1.34)\n\nFresh deployments are commonly left unconfigured for extended periods on shared hosting and cloud environments, making this window reliably exploitable in real-world scenarios.\n\nFix: Remove lines 115-118 from Core/Controller/Installer.php:\n\n    if (\u0027TRUE\u0027 === $this-\u003erequest-\u003equery(\u0027phpinfo\u0027, \u0027\u0027)) {\n        phpinfo();\n        return;\n    }",
  "id": "GHSA-vrxf-vrc4-22p7",
  "modified": "2026-05-07T19:43:24Z",
  "published": "2026-05-07T19:43:24Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-vrxf-vrc4-22p7"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/NeoRazorX/facturascripts"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "FacturaScripts Vulnerable to Unauthenticated phpinfo() Disclosure via Installer Endpoint"
}