CVE-2026-40521 — Vulnerability intelligence
FrontAccounting — FrontAccounting
Published:
- CVSS
- 8.7
- CISA KEV
- Not listed; not proof of no exploitation
Original source text (not a translation)
FrontAccounting before 2.4.20 contains a path traversal vulnerability in the attachment upload handler that allows authenticated attackers to execute arbitrary code by uploading files with traversal sequences in the unique_name parameter. Attackers can supply path traversal sequences ../../../shell.php to write files outside the intended attachments directory into the web root, and by uploading PHP files without extension validation, achieve remote code execution as the web server user.