CVE-2026-33273: Icz Matcha Invoice

High severity, CVSS 7.2. EPSS: 0.4% chance of exploitation in the next 30 days.

Unrestricted upload of file with dangerous type issue exists in MATCHA INVOICE 2.6.6 and earlier. If this vulnerability is exploited, an arbitrary file may be created by an administrator of the product. As a result, arbitrary code may be executed on the server.

Affected products

• Icz Matcha Invoice: up to and including 2.6.6

Published 2026-04-08. Last modified 2026-07-24.