Vulnerability Description
FrontAccounting before 2.4.20 contains a path traversal vulnerability in the attachment upload handler that allows authenticated attackers to execute arbitrary code by uploading files with traversal sequences in the unique_name parameter. Attackers can supply path traversal sequences ../../../shell.php to write files outside the intended attachments directory into the web root, and by uploading PHP files without extension validation, achieve remote code execution as the web server user.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/FrontAccountingERP/FA/commit/701fea6848da4a02fb83d30f07a9c047
- https://jivasecurity.com/writeups/frontaccounting-rce-attachment-upload-cve-2026
- https://sourceforge.net/p/frontaccounting/news/2026/04/release-2420/
- https://www.vulncheck.com/advisories/frontaccounting-path-traversal-rce-via-atta
FAQ
What is CVE-2026-40521?
CVE-2026-40521 is a vulnerability with a CVSS score of 8.8 (HIGH). FrontAccounting before 2.4.20 contains a path traversal vulnerability in the attachment upload handler that allows authenticated attackers to execute arbitrary code by uploading files with traversal s...
How severe is CVE-2026-40521?
CVE-2026-40521 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-40521?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.