CVE-2026-23476: 
PHP vulnerability analysis and mitigation

CVE-2026-23476 is a reflected Cross-Site Scripting (XSS) vulnerability in FacturaScripts, an open-source accounting and ERP application. The flaw exists in how database error messages are rendered using Twig's | raw filter, which bypasses HTML escaping and allows unsanitized user input to be executed as JavaScript in the victim's browser. It affects all FacturaScripts versions prior to 2025.8 (specifically confirmed in versions 2025.61 and 2025.71). The vulnerability was discovered on December 31, 2025, and publicly disclosed on February 2, 2026. It carries a CVSS v3.1 base score of 5.4 (Medium) (GitHub Advisory).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically in Core/View/Macro/Utils.html.twig at line 27, where the Twig template renders log messages using {{ item.message | raw }} — bypassing Twig's default auto-escaping. When a user-controlled value (e.g., a string passed to the code query parameter) is submitted to an Edit controller endpoint, the PostgreSQL database throws a type error that includes the raw input in its error message. This error is logged via MiniLog in Core/Base/DataBase.php (around line 236) and subsequently rendered unescaped to the page, causing the browser to execute any embedded JavaScript. Exploitation requires the attacker to have at least a low-privilege authenticated session and requires the victim to interact with a crafted URL (GitHub Advisory, FacturaScripts Advisory).

Successful exploitation allows an attacker to inject arbitrary JavaScript into error messages displayed to other authenticated users. Because session cookies are protected with the HttpOnly flag, direct cookie theft is not possible; however, attackers can inject fake login forms to harvest credentials through phishing, scrape sensitive financial data (invoices, customer records, payment details) visible on the page, inject keyloggers, or bypass CSRF protections by extracting the multireqtoken from the page to perform unauthorized actions as the victim. In a financial application context, compromise of an admin account could result in fraudulent invoices, redirected payments, and GDPR-relevant customer data breaches (GitHub Advisory, FacturaScripts Advisory).

A proof-of-concept exploit is publicly documented in the GitHub Security Advisory, including a working credential-harvesting server script and crafted URLs targeting multiple Edit controller endpoints. There is no evidence of active in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.019% (5th percentile), indicating a low current probability of exploitation in the wild (GitHub Advisory).

1. Reconnaissance: Identify internet-facing FacturaScripts instances running versions prior to 2025.8 using web search, Shodan, or Censys. Confirm the version from publicly accessible pages or HTTP headers.
2. Obtain low-privilege access: Register or obtain any valid user account on the target instance — administrative privileges are not required.
3. Craft malicious URL: Construct a URL targeting an Edit controller endpoint with a JavaScript payload embedded in the code parameter, e.g., http://TARGET/EditProducto?code=<script>PAYLOAD</script>. The payload can be a fake login form or data-exfiltration script.
4. Trigger database error: When the crafted URL is visited by an authenticated user, the application passes the non-integer code value to PostgreSQL, which throws a type error. The error message — containing the raw payload — is logged via MiniLog and rendered unescaped via {{ item.message | raw }} in Utils.html.twig.
5. Execute payload: The victim's browser executes the injected JavaScript. For credential phishing, the injected form mimics a session-timeout login prompt and submits credentials to an attacker-controlled server.
6. Harvest credentials: The attacker's listener (e.g., a Python HTTP server) captures submitted usernames and passwords from the victim (GitHub Advisory, FacturaScripts Advisory).

• Network: Outbound HTTP GET requests from the FacturaScripts server or victim browsers to unexpected external IPs/domains (attacker-controlled credential-harvesting servers); unusual query parameters containing <script>, HTML tags, or encoded JavaScript in access logs.
• Logs: Web server access logs showing requests to Edit controller endpoints (e.g., /EditProducto, /EditCliente, /EditFacturaCliente, /EditProveedor) with non-integer or script-containing code parameter values; application error logs showing PostgreSQL type errors triggered by string inputs to integer fields.
• Browser/User Reports: Users reporting unexpected login prompts or session-timeout dialogs while already authenticated; reports of credentials being used from unfamiliar locations shortly after clicking shared links.

Update FacturaScripts to version 2025.8 or later, which removes the | raw filter from Core/View/Macro/Utils.html.twig (commit 2afd98c), restoring Twig's default HTML auto-escaping for all log messages (FacturaScripts Release, Fix Commit). As interim mitigations where patching is not immediately possible: deploy a Web Application Firewall (WAF) to filter script injection patterns in query parameters; enforce strict Content Security Policy (CSP) headers to block inline script execution; sanitize error messages before logging using htmlspecialchars($message, ENT_QUOTES, 'UTF-8'); and validate the code parameter format (integer-only) before it reaches the database layer (GitHub Advisory).

The vulnerability was reported by security researcher h4cd0c and published by the FacturaScripts maintainer (NeoRazorX) on February 2, 2026. The fix was committed promptly by Carlos Garcia, the project lead. No significant broader media coverage or notable community commentary beyond the GitHub advisory has been identified.