{"id":"CVE-2026-27964","kind":"vulnerability","aliases":["CVE-2026-27964","GHSA-gq5c-rw37-g46c"],"related":[],"title":"FacturaScripts vulnerable to Reflected Cross-Site Scripting (XSS) via Cookie Manipulation","description":"### Summary\nA Reflected Cross-Site Scripting (XSS) vulnerability exists in the fsNick cookie parameter. The application reflects the cookie's value directly into the HTML without sanitization.\n\n### Details\nThe fsNick cookie is rendered into the DOM without encoding. While the server does reject the modified session and forces a logout, the HTML containing the payload reaches the browser first. This lets the script execute immediately upon load, effectively beating the redirect.\n\n### PoC\n\n1. Log in to the application with any valid account.\n<img width=\"2078\" height=\"302\" alt=\"image\" src=\"https://github.com/user-attachments/assets/d8a9a779-44e0-4a3e-839f-0a031868fbd5\" />\n\n2. Capture any the GET request .\n<img width=\"1267\" height=\"276\" alt=\"image\" src=\"https://github.com/user-attachments/assets/22e43f73-4f86-4cab-a074-7aba584a71ac\" />\n\n3. Modify  the value of \"fsNick\" with the following JavaScript:\n`<script>alert(window.origin)</script>`\n\n4. Send the modified request.\n<img width=\"1569\" height=\"319\" alt=\"image\" src=\"https://github.com/user-attachments/assets/ade88db1-aadc-4c50-9e02-d09888067e98\" />\n\n5. Result\n<img width=\"1217\" height=\"771\" alt=\"image\" src=\"https://github.com/user-attachments/assets/5858fe9f-127a-4845-b484-5a7ef4ae2cb4\" />\n\n### Impact\nThe payload executes before the session ends, which could potentially allow for a single unauthorized action before the logout.","summary":"FacturaScripts copies the fsNick cookie value into the HTML without encoding it, so a crafted cookie can run JavaScript in a logged-in user's browser. The server logs the user out after rejecting the modified session, but the injected script runs first, so an attacker may get one action before the logout.","severity":"low","cvss":3.9,"epss":0.00104,"exploited":false,"exploited_at":null,"products":[{"name":"facturascripts/facturascripts","fixed":["2025.8"],"affected":"< 2025.8","ecosystem":"composer"},{"name":"facturascripts/facturascripts","fixed":["2025.81"],"affected":">= 2025.11, < 2025.81","ecosystem":"composer"}],"ecosystems":["composer"],"tags":["cwe-79","facturascripts","package","php","self-hosted"],"not_affected_if":["fixed-version","managed-hosting"],"how_to_check":"- Check the installed version of `facturascripts/facturascripts` in `composer.lock` or with `composer show facturascripts/facturascripts`\n- Compare it against the fixed versions listed in the fix section\n- Confirm whether the app is reachable from the internet, since the attack needs a victim to load a crafted link or request","fix":"- `facturascripts/facturascripts` below `2025.8`: move to `2025.8`\n- `facturascripts/facturascripts` from `2025.11` below `2025.81`: move to `2025.81`","status":"open","published_at":"2026-05-07T19:34:28+00:00","first_seen_at":"2026-10-30T16:59:39+00:00","triaged_at":"2026-10-30T17:00:48+00:00","updated_at":"2026-10-30T17:00:48+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-30T17:00:48Z","model":"claude-haiku-5-5","output":{"fix":"- `facturascripts/facturascripts` below `2025.8`: move to `2025.8`\n- `facturascripts/facturascripts` from `2025.11` below `2025.81`: move to `2025.81`","reach":"internet","title":"FacturaScripts: fsNick cookie reflected into page enables script injection","impact":"low","summary":"FacturaScripts copies the fsNick cookie value into the HTML without encoding it, so a crafted cookie can run JavaScript in a logged-in user's browser. The server logs the user out after rejecting the modified session, but the injected script runs first, so an attacker may get one action before the logout.","audience":"businesses","category":"package","nicknames":[],"who_cares":["facturascripts","php","self-hosted"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Script runs in a logged-in user's browser, one action before logout","analyst_note":"","how_to_check":"- Check the installed version of `facturascripts/facturascripts` in `composer.lock` or with `composer show facturascripts/facturascripts`\n- Compare it against the fixed versions listed in the fix section\n- Confirm whether the app is reachable from the internet, since the attack needs a victim to load a crafted link or request","plain_action":"","needs_analyst":false,"not_affected_if":["fixed-version","managed-hosting"],"who_is_affected":"Self-hosted FacturaScripts installations in the affected version ranges are exposed, because the fsNick cookie value is rendered into HTML without encoding. The attack needs a logged-in user to be tricked into sending a crafted request, so instances used only on a closed internal network are lower risk. Teams on the fixed versions or on a hosted service that already runs them can skip it.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"low"},"cost_usd":0.000792,"input_tokens":4710,"output_tokens":642,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,22A '-27964':15A,23A '-79':27B '1':161C '2':171C '3':177C '4':187C '5':192C 'account':170C 'action':84B,210C 'allow':205C 'applic':104C,166C 'attack':80B 'beat':157C 'browser':60B,146C 'captur':172C 'contain':141C 'cooki':11A,38B,49B,101C,107C,119C 'copi':35B 'could':203C 'craft':48B 'cross':6A,92C 'cross-sit':5A,91C 'cve':13A,21A 'cwe':26B 'detail':116C 'direct':110C 'dom':124C 'effect':156C 'encod':44B,126C 'end':201C 'execut':152C,197C 'exist':97C 'facturascript':1A,28B,34B 'facturascripts/facturascripts':24A,25A 'first':77B,147C 'follow':185C 'forc':136C 'fsnick':37B,100C,118C,182C 'g46c':20A 'get':82B,175C 'ghsa':17A 'ghsa-gq5c-rw37-g46c':16A 'gq5c':18A 'host':33B 'html':42B,113C,140C 'immedi':153C 'impact':194C 'inject':74B 'javascript':52B,186C 'let':149C 'load':155C 'log':56B,63B,162C 'logged-in':55B 'logout':87B,138C,213C 'manipul':12A 'may':81B 'modifi':70B,133C,178C,190C 'one':83B 'packag':29B 'paramet':102C 'payload':143C,196C 'php':30B 'poc':160C 'potenti':204C 'reach':144C 'redirect':159C 'reflect':4A,90C,105C 'reject':68B,131C 'render':121C 'request':176C,191C 'result':193C 'run':51B,76B 'rw37':19A 'sanit':115C 'script':8A,75B,94C,151C 'self':32B 'self-host':31B 'send':188C 'server':62B,129C 'session':71B,134C,200C 'singl':208C 'site':7A,93C 'summari':88C 'unauthor':209C 'upon':154C 'user':58B,65B 'valid':169C 'valu':39B,109C,180C 'via':10A 'vulner':2A,96C 'without':43B,114C,125C 'xss':9A,95C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted FacturaScripts installations in the affected version ranges are exposed, because the fsNick cookie value is rendered into HTML without encoding. The attack needs a logged-in user to be tricked into sending a crafted request, so instances used only on a closed internal network are lower risk. Teams on the fixed versions or on a hosted service that already runs them can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-05-07T19:34:28+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-gq5c-rw37-g46c","url":"https://github.com/advisories/GHSA-gq5c-rw37-g46c","severity":"low","published_at":"2026-05-07T19:34:28+00:00","modified_at":"2026-10-30T16:55:33+00:00","first_seen_at":"2026-10-30T16:59:39+00:00","fetched_at":"2026-10-30T16:59:39+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-27964","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27964","severity":null,"published_at":"2026-05-18T22:16:38+00:00","modified_at":"2026-07-24T13:10:00+00:00","first_seen_at":"2026-10-30T17:01:26+00:00","fetched_at":"2026-10-30T17:01:26+00:00","note":null}],"documents":[{"id":24715,"url":"https://api.github.com/repos/NeoRazorX/facturascripts/security-advisories/GHSA-gq5c-rw37-g46c","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":24716,"url":"https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-gq5c-rw37-g46c","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":24717,"url":"https://github.com/NeoRazorX/facturascripts/commit/9066e10326029adf012114e27eb5f3f33f78ecfd","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}