---
id: "CVE-2026-27964"
kind: "vulnerability"
aliases: ["CVE-2026-27964", "GHSA-gq5c-rw37-g46c"]
title: "FacturaScripts vulnerable to Reflected Cross-Site Scripting (XSS) via Cookie Manipulation"
severity: "low"
cvss: 3.9
epss: 0.00104
exploited: false
status: "open"
category: "package"
products: [{"name": "facturascripts/facturascripts", "fixed": ["2025.8"], "affected": "< 2025.8", "ecosystem": "composer"}, {"name": "facturascripts/facturascripts", "fixed": ["2025.81"], "affected": ">= 2025.11, < 2025.81", "ecosystem": "composer"}]
ecosystems: ["composer"]
tags: ["cwe-79", "facturascripts", "package", "php", "self-hosted"]
not_affected_if: ["fixed-version", "managed-hosting"]
published_at: "2026-05-07T19:34:28+00:00"
first_seen_at: "2026-10-30T16:59:39+00:00"
updated_at: "2026-10-30T17:00:48+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-gq5c-rw37-g46c", "first_seen_at": "2026-10-30T16:59:39+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27964", "first_seen_at": "2026-10-30T17:01:26+00:00"}]
---

# FacturaScripts vulnerable to Reflected Cross-Site Scripting (XSS) via Cookie Manipulation

FacturaScripts copies the fsNick cookie value into the HTML without encoding it, so a crafted cookie can run JavaScript in a logged-in user's browser. The server logs the user out after rejecting the modified session, but the injected script runs first, so an attacker may get one action before the logout.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- composer:facturascripts/facturascripts affected < 2025.8 fixed 2025.8
- composer:facturascripts/facturascripts affected >= 2025.11, < 2025.81 fixed 2025.81

## How to check

- Check the installed version of `facturascripts/facturascripts` in `composer.lock` or with `composer show facturascripts/facturascripts`
- Compare it against the fixed versions listed in the fix section
- Confirm whether the app is reachable from the internet, since the attack needs a victim to load a crafted link or request

## Fix

- `facturascripts/facturascripts` below `2025.8`: move to `2025.8`
- `facturascripts/facturascripts` from `2025.11` below `2025.81`: move to `2025.81`

## Timeline

- 2026-10-30T16:59:39+00:00 ghsa https://github.com/advisories/GHSA-gq5c-rw37-g46c
- 2026-10-30T17:01:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-27964

## Documents

- [advisory] Maintainer's advisory: api.github.com https://api.github.com/repos/NeoRazorX/facturascripts/security-advisories/GHSA-gq5c-rw37-g46c
- [advisory] Maintainer's advisory: github.com https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-gq5c-rw37-g46c
- [fix] Patch: github.com https://github.com/NeoRazorX/facturascripts/commit/9066e10326029adf012114e27eb5f3f33f78ecfd

## From the sources

### Summary
A Reflected Cross-Site Scripting (XSS) vulnerability exists in the fsNick cookie parameter. The application reflects the cookie's value directly into the HTML without sanitization.

### Details
The fsNick cookie is rendered into the DOM without encoding. While the server does reject the modified session and forces a logout, the HTML containing the payload reaches the browser first. This lets the script execute immediately upon load, effectively beating the redirect.

### PoC

1. Log in to the application with any valid account.
<img width="2078" height="302" alt="image" src="https://github.com/user-attachments/assets/d8a9a779-44e0-4a3e-839f-0a031868fbd5" />

2. Capture any the GET request .
<img width="1267" height="276" alt="image" src="https://github.com/user-attachments/assets/22e43f73-4f86-4cab-a074-7aba584a71ac" />

3. Modify  the value of "fsNick" with the following JavaScript:
`<script>alert(window.origin)</script>`

4. Send the modified request.
<img width="1569" height="319" alt="image" src="https://github.com/user-attachments/assets/ade88db1-aadc-4c50-9e02-d09888067e98" />

5. Result
<img width="1217" height="771" alt="image" src="https://github.com/user-attachments/assets/5858fe9f-127a-4845-b484-5a7ef4ae2cb4" />

### Impact
The payload executes before the session ends, which could potentially allow for a single unauthorized action before the logout.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_