OpenSourcePOS 3.4.1 contains a Local File Inclusion (LFI) vulnerability in the Sales.php::getInvoice() function.

Code

The project this record applies to. Exploit listings stay in References.

• Repository · github.com

Timeline

Detection, updates, and resolution for this record.

1. Feb 20, 2026 · NIST NVD

   Detected

   OpenSourcePOS 3.4.1 contains a Local File Inclusion (LFI) vulnerability in the Sales.php::getInvoice() function. An attacker can read arbitrary files on the web server by manipulating the Invoice Type configuration. This issue can be chained with the file upload functionality to achieve Remote Code Execution (RCE).

2. Jun 17, 2026 · NIST NVD

   Updated

   OpenSourcePOS 3.4.1 contains a Local File Inclusion (LFI) vulnerability in the Sales.php::getInvoice() function. An attacker can read arbitrary files on the web server by manipulating the Invoice Type configuration. This issue can be chained with the file upload functionality to achieve Remote Code Execution (RCE).

Affected

• cpe opensourcepos/open source point of sale3.4.1

Sources

• NIST NVDVulnerability recordCVE-2026-26746

  OpenSourcePOS 3.4.1 contains a Local File Inclusion (LFI) vulnerability in the Sales.php::getInvoice() function. An attacker can read arbitrary files on the web server by manipulating the Invoice Type configuration. This issue can be chained with the file upload functionality to

  nvd.nist.gov

References

• Exploit · github.com
• Product · github.com