CVE-2026-26746
📋 TL;DR
OpenSourcePOS 3.4.1 contains a Local File Inclusion vulnerability that allows attackers to read arbitrary files on the web server by manipulating invoice type settings. This can be combined with file upload functionality to achieve remote code execution. All users running OpenSourcePOS 3.4.1 are affected.
💻 Affected Systems
- OpenSourcePOS
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full server compromise through remote code execution, allowing data theft, malware deployment, and complete system control.
Likely Case
Sensitive file disclosure (configuration files, database credentials, source code) leading to further attacks.
If Mitigated
Limited impact if proper file permissions and input validation are in place, though information disclosure may still occur.
🎯 Exploit Status
Exploit requires some level of access to manipulate invoice settings; RCE requires chaining with file upload.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://github.com/opensourcepos/opensourcepos
Restart Required: No
Instructions:
1. Monitor official OpenSourcePOS repository for updates. 2. Apply patch when available. 3. Test in development environment before production.
🔧 Temporary Workarounds
Disable file upload functionality
allPrevents chaining LFI with file upload to achieve RCE
Restrict file permissions
linuxSet strict file permissions on web server directories
chmod 640 /path/to/opensourcepos/*
chown www-data:www-data /path/to/opensourcepos/
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block LFI patterns
- Restrict network access to OpenSourcePOS interface to trusted IPs only
🔍 How to Verify
Check if Vulnerable:
Check if running OpenSourcePOS version 3.4.1; test by attempting to access local files through invoice type parameter.Check Version:
Check application/controllers/Sales.php for version references or check admin panelVerify Fix Applied:
Verify version is updated beyond 3.4.1; test LFI attempts return errors instead of file contents.📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns in web server logs
- Requests with ../ sequences or file path manipulations
Network Indicators:
- HTTP requests with suspicious file path parameters in invoice-related endpoints
SIEM Query:
web_access_logs | where url contains "Sales.php" and (url contains "../" or url contains "file=" or url contains "path=")