CVE-2017-1000238
HighSummary
InvoicePlane version 1.4.10 is vulnerable to an Arbitrary File Upload, allowing an authenticated user to upload a malicious file to the webserver. An attacker can upload a script that can compromise the webserver.
Risk Assessment
This vulnerability poses a risk of an attacker gaining control over the server, potentially leading to data loss or security breaches.
Recommendation
It is recommended to update InvoicePlane to the latest version and implement appropriate security measures to restrict unauthorized file uploads.
Other vulnerabilities in InvoicePlane 1.4.10
See all- CVE-2025-67084Critical
InvoicePlane through 1.6.3 contains a file upload vulnerability allowing authenticated attackers to upload arbitrary PHP files into attachments, which can later be executed remotely, leading to Remote Code Execution (RCE).
- CVE-2021-29024High
In InvoicePlane 1.5.11, a misconfigured web server allows an unauthenticated attacker to list directories and download files that should be private via directory traversal.
- CVE-2021-29023Medium
InvoicePlane 1.5.11 lacks rate-limiting for password reset and uses a weak, predictable token generation mechanism.
- CVE-2021-29022Medium
InvoicePlane 1.5.11 discloses the full path of the file upload directory when using the upload feature.
Original NVD description (English source)
InvoicePlane version 1.4.10 is vulnerable to a Arbitrary File Upload resulting in an authenticated user can upload a malicious file to the webserver. It is possible for an attacker to upload a script which is able to compromise the webserver.