Crater Invoice CVE-2026-57863

Exploitation requires an active, authenticated session as a 'company owner' within Crater Invoice - this is a defined application-level role, not general user access, and must be legitimately provisioned or obtained via credential compromise. The self-update API's unzip endpoint must be network-reachable from the attacker (AV:N confirms this is a web-exposed endpoint). The PHP web server process must retain write permissions to the application's public/ directory, which is standard in default Crater Invoice deployments on shared or VPS hosting. No non-default configuration flags or special server settings are required to trigger the vulnerability. The key limiting factor is the company-owner credential requirement: unauthenticated or low-privilege users cannot reach the vulnerable endpoint. In SaaS or multi-tenant deployments where many parties hold company-owner accounts, this constraint offers limited protection.

The CVSS 4.0 score of 8.7 with AV:N/AC:L/AT:N/PR:L/UI:N accurately reflects a high-severity but not zero-barrier vulnerability. The PR:L (low privilege required) metric corresponds to the company-owner role requirement - a meaningful but attainable credential in a multi-tenant invoicing deployment, where any legitimate business customer could be the attacker. Attack complexity is genuinely low: the exploitation path is mechanical (craft a malicious ZIP, POST it to the endpoint, trigger the webshell). A public PoC hosted on GitHub (sermikr0/cc58727e6a777b6ea1104e923803a0ba) substantially lowers the skill floor for exploitation. EPSS data was not available in the provided intelligence. The absence of a CISA KEV listing suggests exploitation has not been observed at scale, but this does not significantly reduce urgency given the PoC availability and direct RCE outcome. The CVSS 4.0 subsequent-system impact is SC:N/SI:N/SA:N, meaning the formal scoring does not account for lateral movement from the RCE foothold - defenders should treat post-exploitation risk as higher than the vector alone suggests.

An attacker holding a company-owner account logs into a Crater Invoice instance and submits a crafted ZIP archive to the self-update unzip endpoint, where an entry named ../../public/cmd.php contains a PHP webshell. The server's ZipArchive::extractTo() writes the file to the publicly accessible public/cmd.php path without restriction. The attacker then issues HTTP GET requests to https://target/cmd.php?cmd=id to execute arbitrary OS commands as the web server user, achieving persistent RCE; the public PoC on GitHub demonstrates this exact technique.