CVE-2026-33273

OVERVIEW: CVE-2026-33273 is an unrestricted file upload vulnerability affecting MATCHA INVOICE version 2.6.6 and earlier. The flaw permits attackers to upload files with dangerous types, potentially leading to arbitrary code execution on affected servers. SEVERITY: This vulnerability carries a CVSS 3.1 score of 7.2 (HIGH) with a network-based attack vector requiring no user interaction. While the attack requires high-level administrator privileges, successful exploitation could result in complete compromise of confidentiality, integrity, and availability. The FAUCET Risk Score of 48.0/100 indicates moderate concern within the broader threat landscape. EXPLOITATION STATUS: The vulnerability is currently listed on the Active Hot List, suggesting active monitoring and potential exploitation attempts. However, it does not appear in the Known Exploited Vulnerabilities (KEV) catalog, and its EPSS score of 0.00052 indicates minimal probability of exploitation in the wild relative to other CVEs. No publicly available exploit code has been identified at this time. RECOMMENDATION: Organizations running MATCHA INVOICE 2.6.6 or earlier should prioritize patching to the latest version and restrict administrative access to trusted personnel only.