CVE-2026-26746

Published: Feb 20, 2026Modified: Jun 17, 2026

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

OpenSourcePOS 3.4.1 contains a Local File Inclusion (LFI) vulnerability in the Sales.php::getInvoice() function. An attacker can read arbitrary files on the web server by manipulating the Invoice Type configuration. This issue can be chained with the file upload functionality to achieve Remote Code Execution (RCE).

Affected (1)

Products: Opensourcepos: Open Source Point Of Sale

1 product

Open Source Point Of Sale

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Opensourcepos Open Source Point Of Sale	Version 3.4.1

Related CWEs

Unrestricted Upload of File with Dangerous Type

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

References (2)

https://github.com/hungnqdz/CVE-2026-26746/blob/main/CVE-2026-26746.md

Source: cve@mitre.org

ExploitMitigationThird Party Advisory

https://github.com/opensourcepos/opensourcepos

Source: cve@mitre.org

Product

Timeline

No history available yet.