MATCHA INVOICE Unrestricted File Upload Vulnerability Allowing Arbitrary Code Execution

A vulnerability allowing unrestricted file uploads of dangerous types has been identified in MATCHA INVOICE versions through 2.6.6. This issue enables administrators to upload arbitrary files, which could lead to the execution of arbitrary code on the server.

Impact

Exploitation of this vulnerability allows for arbitrary file uploads by administrators, potentially leading to the execution of arbitrary code on the server.

Remediation

Users are advised to update MATCHA INVOICE to version 2.6.7, available on the product's download page. Instructions for updating from previous versions can be found on the developer's blog.