CVE Catalog
CVE-2025-67084
CriticalSummary
InvoicePlane through 1.6.3 contains a file upload vulnerability allowing authenticated attackers to upload arbitrary PHP files into attachments, which can later be executed remotely, leading to Remote Code Execution (RCE).
Risk Assessment
An authenticated attacker can execute arbitrary code on the server, potentially leading to system compromise and data breach.
Recommendation
Update InvoicePlane to the latest version and restrict allowed file types in attachments.
Original NVD description (English source)
File upload vulnerability in InvoicePlane through 1.6.3 allows authenticated attackers to upload arbitrary PHP files into attachments, which can later be executed remotely, leading to Remote Code Execution (RCE).