CVE-2025-67084
CriticalSummary
InvoicePlane through 1.6.3 contains a file upload vulnerability allowing authenticated attackers to upload arbitrary PHP files into attachments, which can later be executed remotely, leading to Remote Code Execution (RCE).
Risk Assessment
An authenticated attacker can execute arbitrary code on the server, potentially leading to system compromise and data breach.
Recommendation
Update InvoicePlane to the latest version and restrict allowed file types in attachments.
Other vulnerabilities in InvoicePlane
See all- CVE-2017-1000238High
InvoicePlane version 1.4.10 is vulnerable to an Arbitrary File Upload, allowing an authenticated user to upload a malicious file to the webserver. An attacker can upload a script that can compromise the webserver.
- CVE-2021-29024High
In InvoicePlane 1.5.11, a misconfigured web server allows an unauthenticated attacker to list directories and download files that should be private via directory traversal.
- CVE-2021-29023Medium
InvoicePlane 1.5.11 lacks rate-limiting for password reset and uses a weak, predictable token generation mechanism.
- CVE-2021-29022Medium
InvoicePlane 1.5.11 discloses the full path of the file upload directory when using the upload feature.
Original NVD description (English source)
File upload vulnerability in InvoicePlane through 1.6.3 allows authenticated attackers to upload arbitrary PHP files into attachments, which can later be executed remotely, leading to Remote Code Execution (RCE).