Unrestricted File Upload Vulnerability in MATCHA INVOICE by ICZ
CVE-2026-33273

5.1MEDIUM

Key Information:

Vendor

Icz Corporation

Status
Matcha Invoice
Vendor
CVE Published:
8 April 2026

What is CVE-2026-33273?

A security issue exists in MATCHA INVOICE versions 2.6.6 and earlier, allowing for unrestricted file uploads of potentially harmful file types. When exploited, this vulnerability enables an administrator to create arbitrary files on the server, which can lead to unauthorized code execution. This poses significant risks to server integrity and data security.

Affected Version(s)

MATCHA INVOICE 2.6.6 and earlier

References

https://oss.icz.co.jp/news/?p=1386
https://jvn.jp/en/jp/JVN33581068/

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

CVSS V3.0

Score:
4.7
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.