CVE-2025-67083 Details
Description
Directory traversal vulnerability in InvoicePlane through 1.6.3 allows unauthenticated attackers to read files from the server. The ability to read files and the file type depends on the web server and its configuration.
A directory traversal vulnerability has been identified in InvoicePlane versions through 1.6.3. This vulnerability allows unauthenticated attackers to read files from the server. The impact varies based on the web server configuration and filesystem permissions. The issue arises in the 'get_file' function of the 'guest' endpoint, where the 'filename' parameter is not properly sanitized, enabling traversal sequences to access arbitrary files, potentially including sensitive configuration files or application data.
Users are advised to update to InvoicePlane version 1.6.4, which addresses this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jan 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/InvoicePlane/InvoicePlane | [email protected] | Product |
| https://www.helx.io/blog/advisory-invoice-plane/ | [email protected] | ExploitThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| invoiceplane invoiceplane | < 1.6.4 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jan 22, 2026 | Initial Analysis | [email protected] |
| Jan 15, 2026 | CVE Modified | CISA-ADP |
| Jan 15, 2026 | New CVE Received | [email protected] |