CVE-2026-26746

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-26746

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-26746.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-26746

Published

2026-02-20T00:00:00Z

Modified

2026-07-15T01:48:56.861597493Z

Severity

8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

[none]

Details

OpenSourcePOS 3.4.1 contains a Local File Inclusion (LFI) vulnerability in the Sales.php::getInvoice() function. An attacker can read arbitrary files on the web server by manipulating the Invoice Type configuration. This issue can be chained with the file upload functionality to achieve Remote Code Execution (RCE).

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26746.json",
    "cna_assigner": "mitre"
}

References

Affected packages

Git / github.com/opensourcepos/opensourcepos

Affected ranges

Type

GIT

Repo

https://github.com/opensourcepos/opensourcepos

Events

Introduced

5f395d987b02562092b838073cb2e23a22d2bca4

Last affected

5f395d987b02562092b838073cb2e23a22d2bca4

Database specific

{
    "cpe": "cpe:2.3:a:opensourcepos:open_source_point_of_sale:3.4.1:*:*:*:*:*:*:*",
    "source": "CPE_STRING",
    "extracted_events": [
        {
            "introduced": "3.4.1"
        },
        {
            "last_affected": "3.4.1"
        }
    ]
}

Affected versions

3.*

3.4.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-26746.json"