Crater Invoice through 6.0.6 contains a path traversal vulnerability in the self-update API that allows authenticated company owners to write arbitrary files outside the intended extraction directory by supplying crafted ZIP archives with ../ sequences to the unzip endpoint. Attackers can exploit unsanitized ZIP entry names passed to PHP's ZipArchive::extractTo() to write arbitrary PHP files into the web-accessible public directory and achieve remote code execution on the server.

Crater Invoice through version 6.0.6 contains a critical path traversal vulnerability in its self-update API. Authenticated company owners can exploit this flaw by supplying crafted ZIP archives containing ../ sequences to the unzip endpoint. The vulnerability stems from unsanitized ZIP entry names being passed directly to PHP's ZipArchive::extractTo() function. This allows attackers to write arbitrary files outside the intended extraction directory, including PHP files into web-accessible public directories. Successful exploitation results in remote code execution (RCE) on the server. The vulnerability requires authentication as a company owner, slightly limiting the attack surface but still posing a severe risk in multi-tenant or compromised credential scenarios. Public proof-of-concept and advisories are available, increasing exploitation risk.