Summary > Live PoC verified 2026-04-30 against a stock FacturaScripts master at 127.0.0.1:8081. A low-privilege user (lowpriv) created a customer with nombre = "=SUM(1+1)*cmd|/c calc!A1". An admin then exported ListClie…
| CVE ID | CVE-2026-45263 |
| Vendor | composer |
| Affected Product | facturascripts/facturascripts |
| Vulnerability Type | Vulnerability |
| CVSS Score | 8.0 (HIGH) |
| Actively Exploited | ❌ No known exploitation |
| Patch Status | See Vendor Advisory → |
| Reported By | CYBERDUDEBIVASH SENTINEL APEX Intelligence (via github_advisories) |
#
127.0.0.1:8081. A low-privilege user (lowpriv) created a customer with nombre = "=SUM(1+1)*cmd|/c calc!A1". An admin then exported ListCliente to CSV via ?action=export&option=CSV. The downloaded file contains the raw payload as the first cell of the nombre column, with no leading single quote and no escape. Excel and LibreOffice will execute the formula on open, including DDE invocations such as =cmd|'/c calc'!A1 that spawn arbitrary processes on the admin workstation. Core/Lib/Export/CSVExport.php::writeData() wraps every cell in the configured delimiter (") and concatenates without inspecting the first character of the value. Spreadsheet applications interpret a cell that starts withSigma rules, YARA signatures, IOC table, and SIEM queries for Splunk, Elastic, Sentinel, and Chronicle — deployable in 5 minutes.