File upload vulnerability in InvoicePlane through 1.6.3 allows authenticated attackers to upload arbitrary PHP files into attachments, which can later be executed remotely, leading to Remote Code Execution (RCE).
References
| Link | Resource |
|---|---|
| https://github.com/InvoicePlane/InvoicePlane | Product |
| https://www.helx.io/blog/advisory-invoice-plane/ | Exploit Third Party Advisory |
Configurations
History
22 Jan 2026, 16:03
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/InvoicePlane/InvoicePlane - Product | |
| References | () https://www.helx.io/blog/advisory-invoice-plane/ - Exploit, Third Party Advisory | |
| First Time |
Invoiceplane invoiceplane
Invoiceplane |
|
| CPE | cpe:2.3:a:invoiceplane:invoiceplane:*:*:*:*:*:*:*:* |
22 Jan 2026, 04:15
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.9 |
15 Jan 2026, 17:16
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.5 |
| CWE | CWE-616 |
15 Jan 2026, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-01-15 15:15
Updated : 2026-01-22 16:03
NVD link : CVE-2025-67084
Mitre link : CVE-2025-67084
CVE.ORG link : CVE-2025-67084
JSON object : View
Products Affected
invoiceplane
- invoiceplane
CWE
CWE-616
Incomplete Identification of Uploaded File Variables (PHP)