CVE-2026-57863: Crater Invoice Path Traversal Vulnerability

CVE-2026-57863 Overview

CVE-2026-57863 is a path traversal vulnerability in Crater Invoice through version 6.0.6. The flaw resides in the self-update API's unzip endpoint, which extracts user-supplied ZIP archives without sanitizing entry names. Authenticated company owners can submit crafted archives containing ../ sequences to write arbitrary files outside the intended extraction directory. Writing a PHP file into the web-accessible public directory yields remote code execution on the underlying server. The vulnerability is tracked under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory).

Critical Impact
An authenticated company owner can achieve remote code execution on the Crater Invoice host by uploading a ZIP archive with traversal sequences to the update endpoint.

Affected Products

Crater Invoice through 6.0.6
Self-update API unzip endpoint
Deployments exposing the update functionality to company-owner accounts

Discovery Timeline

2026-08-25 - CVE-2026-57863 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-57863

Vulnerability Analysis

Crater Invoice exposes a self-update workflow that accepts ZIP archives and extracts them server-side using PHP's ZipArchive::extractTo(). The application passes ZIP entry names directly to the extraction routine without validating or normalizing the path components. When an archive contains entries such as ../../public/shell.php, the extractor resolves the path relative to the target directory and writes the file at a location under attacker control.

Because the Crater application root contains a public directory served by the web server, an attacker can drop a PHP script into that directory. Requesting the file through the web server executes attacker-controlled code in the context of the PHP-FPM or web server user. This converts a file-write primitive into full remote code execution.

Exploitation requires authentication as a company owner, which limits opportunistic mass exploitation. However, company owners are legitimate application users, not administrators of the underlying host, so successful exploitation crosses a trust boundary.

Root Cause

The root cause is missing validation of ZIP entry names before invoking ZipArchive::extractTo(). PHP's ZipArchive does not sanitize traversal sequences within archive entries. Applications that hand untrusted archives to extractTo() must independently reject or normalize entries containing .., absolute paths, or symbolic links. Crater Invoice performs none of these checks on the update endpoint.

Attack Vector

The attacker authenticates to Crater Invoice as a company owner, then submits a crafted ZIP archive to the self-update unzip endpoint. The archive contains one or more entries whose names include ../ sequences resolving to the application's public directory. After extraction, the attacker issues an HTTP request for the planted PHP file, triggering server-side code execution.

Technical details and a proof-of-concept archive are documented in the VulnCheck Security Advisory and a public GitHub Gist PoC.

Detection Methods for CVE-2026-57863

Indicators of Compromise

Unexpected .php files appearing in the Crater public directory or its subdirectories
ZIP uploads to the self-update endpoint from non-administrative user sessions
Web server access log entries requesting unknown PHP files under /public/ followed by outbound network connections from the PHP worker
New or modified files outside the intended update extraction directory with recent timestamps

Detection Strategies

Inspect application and web server logs for POST requests to the update or unzip API endpoints and correlate with subsequent GET requests to newly created PHP files.
Monitor the filesystem for writes originating from the PHP process into web-served directories using file integrity monitoring or auditd rules.
Alert on child processes such as sh, bash, curl, wget, or python spawned by the PHP-FPM or web server process, which indicate post-exploitation activity.

Monitoring Recommendations

Enable verbose logging on the Crater update endpoint and forward logs to a centralized SIEM for retention and correlation.
Baseline the contents of the Crater public directory and alert on any file creation not tied to a controlled deployment.
Track authentication events for company-owner accounts, focusing on unusual source IPs or session behavior preceding update API calls.

How to Mitigate CVE-2026-57863

Immediate Actions Required

Restrict network access to the Crater Invoice application, particularly the self-update endpoints, to trusted administrative networks.
Audit company-owner accounts, rotate credentials, and enforce strong authentication to limit who can reach the vulnerable endpoint.
Review the public directory and application root for unexpected PHP files or recently modified content and remove any unauthorized artifacts.
Monitor the VulnCheck advisory for a fixed release and upgrade as soon as it is available.

Patch Information

At the time of publication, no vendor patch is referenced in the NVD entry for versions through 6.0.6. Administrators should track the upstream Crater Invoice project and the linked advisories for a fixed release. Until a patched version is available, apply the compensating controls below.

Workarounds

Disable or remove the self-update unzip endpoint at the web server or reverse proxy layer if the update functionality is not required.
Enforce a web application firewall rule that blocks multipart uploads containing ZIP entries with ../ sequences to the update endpoint.
Run the PHP process with least-privilege filesystem permissions so it cannot write outside a narrowly scoped update staging directory.
Deploy Crater Invoice behind an authenticating reverse proxy that limits the update endpoint to specific administrator IP ranges.

bash

# Example nginx block restricting the update endpoint to trusted IPs
location ~ ^/api/v[0-9]+/update {
    allow 10.0.0.0/24;   # trusted admin subnet
    deny all;
    proxy_pass http://crater_backend;
}