CVE-2026-26746

OpenSourcePOS version 3.4.1 is vulnerable to a Local File Inclusion (LFI) vulnerability within the Sales.php::getInvoice() function. An attacker can manipulate the Invoice Type configuration to read arbitrary files on the web server. Furthermore, this vulnerability can be chained with the softwar...