Unrated severityNVD Advisory· Published Feb 20, 2026· Updated Feb 23, 2026

CVE-2026-26746

Description

OpenSourcePOS 3.4.1 contains a Local File Inclusion (LFI) vulnerability in the Sales.php::getInvoice() function. An attacker can read arbitrary files on the web server by manipulating the Invoice Type configuration. This issue can be chained with the file upload functionality to achieve Remote Code Execution (RCE).

Affected products

OpenSourcePOS/OpenSourcePOSdescription
Opensourcepos/Opensourceposllm-fuzzy
Range: = 3.4.1

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

github.com/hungnqdz/CVE-2026-26746/blob/main/CVE-2026-26746.mdmitre

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000