PT-2026-3028 · Unknown · Invoiceplane

Published 2026-01-15 · Updated 2026-01-22 · CVE-2025-67084

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions InvoicePlane versions through 1.6.3

Description A file upload issue exists in InvoicePlane that allows authenticated attackers to upload arbitrary PHP files into attachments. These uploaded files can then be executed remotely, potentially leading to Remote Code Execution (RCE). The affected API endpoint is the file upload functionality. The vulnerable parameter is the file itself, allowing the upload of malicious PHP scripts.

Recommendations Update InvoicePlane to a version later than 1.6.3.

Exploit

Fix

RCE

Weakness Enumeration

CWE-616

Related Identifiers

CVE-2025-67084

Affected Products

Invoiceplane

References · 6

• 🔥 https://helx.io/blog/advisory-invoice-plane · Exploit
• https://osv.dev/vulnerability/CVE-2025-67084 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-67084 · Security Note
• https://github.com/InvoicePlane/InvoicePlane · Note
• https://twitter.com/CVEnew/status/2012490392285913436 · Twitter Post
• https://t.me/cveNotify/149516 · Telegram Post