Which versions of FrontAccounting are affected by EUVD-2026-40083?

FrontAccounting versions before 2.4.20 contain a remote code execution vulnerability allowing authenticated users to upload PHP files that execute on the web server, enabling attackers with valid…. A patch is available.

Is there a public PoC exploit available for EUVD-2026-40083?

Yes, a public proof-of-concept exploit is available for EUVD-2026-40083. Prioritise patching immediately. EPSS: 0.6%.

How to fix or mitigate EUVD-2026-40083?

Within 24 hours: Inventory all FrontAccounting installations and identify instances running versions prior to 2.4.20; restrict access to attachment upload functionality. Within 7 days: Upgrade all affected systems to FrontAccounting 2.4.20 or later. Within 30 days: Audit upload logs for suspicious activity and verify patched instances are functioning correctly.

FrontAccounting EUVD-2026-40083

Q: What is the CVSS score of EUVD-2026-40083?

EUVD-2026-40083 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.6%.

| CVE-2026-40521 HIGH

Path Traversal (CWE-22)

2026-06-29 VulnCheck

GHSA-9fmm-h59x-wr53

PHP RCE Path Traversal Frontaccounting

8.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network-reachable upload, low complexity, but a low-privileged authenticated account is required (PR:L); web-shell write yields full host compromise so C/I/A all High; scope unchanged as impact is to the vulnerable system.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 29, 2026 - 14:23 vuln.today

DescriptionCVE.org

FrontAccounting before 2.4.20 contains a path traversal vulnerability in the attachment upload handler that allows authenticated attackers to execute arbitrary code by uploading files with traversal sequences in the unique_name parameter. Attackers can supply path traversal sequences ../../../shell.php to write files outside the intended attachments directory into the web root, and by uploading PHP files without extension validation, achieve remote code execution as the web server user.

AnalysisAI

Remote code execution in FrontAccounting before 2.4.20 lets an authenticated user abuse the attachment upload handler to plant a PHP web shell. The handler fails to validate the unique_name parameter, so traversal sequences write attacker-controlled files outside the attachments directory and into the web root, and because file extensions are not validated, an uploaded PHP file executes as the web server user. Publicly available exploit code exists and a vendor patch is available, though the issue is not listed in CISA KEV.

Technical ContextAI

FrontAccounting is an open-source, web-based double-entry accounting/ERP application written in PHP (CPE cpe:2.3:a:frontaccounting:frontaccounting). The flaw is a classic CWE-22 Improper Limitation of a Pathname to a Restricted Directory (path traversal): the file attachment feature builds the destination path from a client-supplied unique_name value without canonicalizing or constraining it, so '../' sequences let the saved file escape the intended attachments folder. Combined with the absence of server-side extension/content-type validation, an attacker can write executable .php content into a web-accessible directory, turning a file-write primitive into code execution under the PHP/web server process context.

RemediationAI

Vendor-released patch: upgrade to FrontAccounting 2.4.20, which addresses the traversal and missing extension validation in the attachment upload handler (release notes: https://sourceforge.net/p/frontaccounting/news/2026/04/release-2420/; fix commit: https://github.com/FrontAccountingERP/FA/commit/701fea6848da4a02fb83d30f07a9c0473d6b7e33). If you cannot upgrade immediately, apply specific compensating controls: restrict access to the attachment upload endpoints to trusted users only and place the whole application behind authentication/VPN to reduce the pool of attackers who can submit uploads; configure the web server to deny PHP execution within the attachments/upload directory (for example an Apache 'php_admin_flag engine off' or removing the PHP handler for that path, or an equivalent nginx location block) so a planted .php file cannot run - note this does not stop the traversal write itself, only execution at the intended location, so it can be bypassed if files land elsewhere in the web root; and add a WAF/proxy rule rejecting requests whose parameters contain '../' or encoded traversal sequences, accepting that aggressive filtering can break legitimate filenames. The durable fix remains upgrading to 2.4.20.