CVE-2026-33273 MEDIUM

CVE-2026-33273

Vendor Icz Corporation
Product MATCHA INVOICE
Weakness CWE-434 · Unrestricted file upload
Published April 8, 2026
Last update April 8, 2026
View on NVD All CVEs

CVSS base score

4.7/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

What the vulnerability does

01Description

Unrestricted upload of file with dangerous type issue exists in MATCHA INVOICE 2.6.6 and earlier. If this vulnerability is exploited, an arbitrary file may be created by an administrator of the product. As a result, arbitrary code may be executed on the server.

Key dates

02Disclosure timeline

April 8, 2026 CVE published
April 8, 2026 Record updated