CVE-2021-29022

MediumCVSS 5.3

Published: 10/05/2021(UTC)Updated: 29/07/2026(UTC)Translated: 29/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.04%

61th percentile - higher than 61% of all known CVEs

InvoicePlane 1.5.11 discloses the full path of the file upload directory when using the upload feature.

Disclosure of the full path can aid an attacker in further system exploration, such as identifying directory structure or sensitive file locations.

Update InvoicePlane to a newer version that fixes this issue, or configure the server to not disclose paths in responses.

Original NVD description (English source)

In InvoicePlane 1.5.11, the upload feature discloses the full path of the file upload directory.