by Kastro
Paper/Archive/CVE-2026-23491

CVE-2026-23491

InvoicePlane InvoicePlane — InvoicePlane has Unauthenticated Path Traversal in Guest Controller

EPSS 5%public exploitCVSS 9.3
critical.is priorityof 100
56
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 91.7.917 × 2018.3Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A path traversal vulnerability exists in the `get_file` method of the `Guest` module's `Get` controller in InvoicePlane up to and including through 1.6.3. The vulnerability allows unauthenticated attackers to read arbitrary files on the server by manipulating the input filename. This leads to the disclosure of sensitive information, including configuration files with database credentials. Version 1.6.4 fixes the issue.

Affected

ProductAffectedFixed inSource
InvoicePlane< 1.6.4–CNA

Scores by source

GitHub_M (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

refgithub.com/InvoicePlane/InvoicePlane/security/advisories/GHSA-88gq-mv54-v3fcrefgithub.com/InvoicePlane/InvoicePlane/commit/add8bb798dde621f886823065ef1841986543c69