CVE-2026-45693

The static file controllers in FacturaScripts decide whether a request is authorized by looking at the URL string instead of the canonical filesystem path. A request that starts with an allow-listed folder name but contains a "../" segment in the middle ends up serving a file from a different...