PT-2026-20490 · Unknown · Invoiceplane

Lukasz-Rybak · Publicado 2026-02-18 · Atualizado 2026-02-20 · CVE-2026-23491

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Crítica

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions InvoicePlane versions through 1.6.3

Description InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A path traversal issue exists in the get file method of the Guest module's Get controller. This allows unauthenticated attackers to read arbitrary files on the server by manipulating the input filename. This can lead to the disclosure of sensitive information, including configuration files with database credentials. The vulnerable method is get file within the Guest module's Get controller. The input filename is the vulnerable parameter.

Recommendations Update InvoicePlane to version 1.6.4 or later.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2026-23491

GHSA-88GQ-MV54-V3FC

Produtos afetados

Invoiceplane

Referências · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23491.json · Exploit
• https://github.com/InvoicePlane/InvoicePlane/security/advisories/GHSA-88gq-mv54-v3fc · Aviso do Fabricante
• https://github.com/InvoicePlane/InvoicePlane/commit/add8bb798dde621f886823065ef1841986543c69 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2026-23491 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-23491 · Aviso do Fabricante
• https://t.me/CVEtracker/45016 · Publicação no Telegram
• https://twitter.com/CVEnew/status/2024258087759327565 · Publicação no Twitter
• https://t.me/cveNotify/152619 · Publicação no Telegram