Path Traversal Vulnerability in InvoicePlane by InvoicePlane
CVE-2026-23491

9.3CRITICAL

Key Information:

Vendor

Invoiceplane

Status
Invoiceplane
Vendor
CVE Published:
18 February 2026

What is CVE-2026-23491?

A path traversal vulnerability exists in the get_file method of the Guest module's Get controller in InvoicePlane versions up to 1.6.3. This issue allows unauthenticated attackers to manipulate input filenames and gain access to arbitrary files on the server. Consequently, this can lead to the exposure of sensitive information, such as configuration files containing database credentials. This vulnerability has been addressed in version 1.6.4.

Affected Version(s)

InvoicePlane < 1.6.4

References

https://github.com/InvoicePlane/InvoicePlane/security/adv...
x_refsource_CONFIRM
https://github.com/InvoicePlane/InvoicePlane/commit/add8b...
x_refsource_MISC

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.