Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.4

FrontAccounting before 2.4.20 allows unauthorized PHP file upload

CVE-2026-40521 · published 4 months ago
Summary

Authenticated users can upload malicious PHP files to the server's root directory, potentially allowing them to execute arbitrary code. This can happen if the software is not updated to version 2.4.20 or later. To fix this, update to the latest version of FrontAccounting.

What to do
  • Update frontaccounting frontaccounting to version 2.4.20 or later.
Affected software
VendorProductAffected versions
frontaccounting frontaccounting < 2.4.20
Original advisory text
FrontAccounting < 2.4.20 Path Traversal RCE via attachment upload
FrontAccounting before 2.4.20 contains a path traversal vulnerability in the attachment upload handler that allows authenticated attackers to execute arbitrary code by uploading files with traversal sequences in the unique_name parameter. Attackers can supply path traversal sequences ../../../shell.php to write files outside the intended attachments directory into the web root, and by uploading PHP files without extension validation, achieve remote code execution as the web server user.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
9.4 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-22Path Traversal
Timeline
Published29 Jun 2026
Updated4 Nov 2026
First seen29 Jun 2026
Sources
CVE-2026-40521 · NVD
CVE-2026-40521 · MITRE
CVE-2026-40521 · OSV
Track software like this
Free during beta