← Back

CVE-2025-67084

nvd nist
Published: Jan 15, 2026Modified: Jun 17, 2026

JSON object

Loading...
9.9
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Exploitability: 3.1 / Impact: 6.0
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

File upload vulnerability in InvoicePlane through 1.6.3 allows authenticated attackers to upload arbitrary PHP files into attachments, which can later be executed remotely, leading to Remote Code Execution (RCE).

Affected (1)

Invoiceplane
1 product
Invoiceplane
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Invoiceplane
Before 1.6.4

Related CWEs

CWE-616
Incomplete Identification of Uploaded File Variables (PHP)
The PHP application uses an old method for processing uploaded files by referencing the four global variables that are set for each file (e.g. $varname, $varname_size, $varname_name, $varname_type). These variables could be overwritten by attackers, causing the application to process unauthorized files.

References (2)

Source: cve@mitre.org
Product
Source: cve@mitre.org
ExploitThird Party Advisory

Timeline

No history available yet.