CVE-2026-33273 — ICZ Corporation / MATCHA INVOICE

CVE-2026-33273

ICZ Corporation / MATCHA INVOICE PUBLISHED

Description (CNA)

Unrestricted upload of file with dangerous type issue exists in MATCHA INVOICE 2.6.6 and earlier. If this vulnerability is exploited, an arbitrary file may be created by an administrator of the product. As a result, arbitrary code may be executed on the server.

Affected (CNA)

Vendor / product	Versions
ICZ Corporation / MATCHA INVOICE	affected 2.6.6 and earlier

CWE

CWE-434

References

https://oss.icz.co.jp/news/?p=1386
https://jvn.jp/en/jp/JVN33581068/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.