CVE-2026-26746

OpenSourcePOS 3.4.1 contains a Local File Inclusion (LFI) vulnerability in the Sales.php::getInvoice() function. An attacker can read arbitrary files on the web server by manipulating the Invoice Type configuration. This issue can be chained with the file upload functionality to achieve Remote Code Execution (RCE).

Score

CVSS 3.1 8.8 High

Status

Analyzed - cve@mitre.org

Published

2026-02-20

Last modified

2026-02-23

Weaknesses

CWE-434

Affected products

• Open Source Point Of Sale (Opensourcepos)

References

• https://github.com/hungnqdz/CVE-2026-26746/blob/main/CVE-2026-26746.md
• https://github.com/opensourcepos/opensourcepos