PT-2026-20490 · Unknown · Invoiceplane

Lukasz-Rybak · Published 2026-02-18 · Updated 2026-02-20 · CVE-2026-23491

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions InvoicePlane versions through 1.6.3

Description InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A path traversal issue exists in the get file method of the Guest module's Get controller. This allows unauthenticated attackers to read arbitrary files on the server by manipulating the input filename. This can lead to the disclosure of sensitive information, including configuration files with database credentials. The vulnerable method is get file within the Guest module's Get controller. The input filename is the vulnerable parameter.

Recommendations Update InvoicePlane to version 1.6.4 or later.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-23491

GHSA-88GQ-MV54-V3FC

Affected Products

Invoiceplane

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23491.json · Exploit
• https://github.com/InvoicePlane/InvoicePlane/security/advisories/GHSA-88gq-mv54-v3fc · Vendor Advisory
• https://github.com/InvoicePlane/InvoicePlane/commit/add8bb798dde621f886823065ef1841986543c69 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-23491 · Security Note
• https://osv.dev/vulnerability/CVE-2026-23491 · Vendor Advisory
• https://t.me/CVEtracker/45016 · Telegram Post
• https://twitter.com/CVEnew/status/2024258087759327565 · Twitter Post
• https://t.me/cveNotify/152619 · Telegram Post