by Kastro
Paper/Archive/CVE-2025-67084

CVE-2025-67084

mitre — File upload vulnerability in InvoicePlane through 1.6.3 allows authenticated attackers to upload arbitrary PHP files into attachments, wh…

EPSS 0.4%public exploitCVSS 9.9
critical.is priorityof 100
47
CVSS 9.9 (ADP)9.9 / 10 × 3029.7Not in CISA KEV+300.0EPSS percentile 38.6.386 × 207.7Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

File upload vulnerability in InvoicePlane through 1.6.3 allows authenticated attackers to upload arbitrary PHP files into attachments, which can later be executed remotely, leading to Remote Code Execution (RCE).

Affected

ProductAffectedFixed inSource
n/an/a–CNA

Scores by source

CISA ADP9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: partial

References

refgithub.com/InvoicePlane/InvoicePlanerefhelx.io/blog/advisory-invoice-plane