PT-2026-3027 · Unknown · Invoiceplane

Published 2026-01-15 · Updated 2026-01-17 · CVE-2025-67083

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions InvoicePlane versions through 1.6.3

Description A directory traversal issue exists in InvoicePlane. This allows unauthenticated attackers to read files from the server. The types of files readable and the extent of access depend on the web server configuration.

Recommendations Update InvoicePlane to a version later than 1.6.3.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-67083

Affected Products

Invoiceplane

References · 5

• 🔥 https://helx.io/blog/advisory-invoice-plane · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-67083 · Security Note
• https://osv.dev/vulnerability/CVE-2025-67083 · Vendor Advisory
• https://github.com/InvoicePlane/InvoicePlane · Note
• https://twitter.com/CVEnew/status/2012490391396749424 · Twitter Post