CVE-2026-77526

"FacturaScripts\Core\UploadedFile::move$destiny, $destinyName" concatenates "$destiny" and "$destinyName" without normalizing the resulting path. Every caller in the codebase passes "UploadedFile::getClientOriginalName" — the unsanitized client-supplied filename — as "$destinyName", so an...