CVE-2025-67083

Description

Directory traversal vulnerability in InvoicePlane through 1.6.3 allows unauthenticated attackers to read files from the server. The ability to read files and the file type depends on the web server and its configuration.

PUBLISHED Reserved 2025-12-08 | Published 2026-01-15 | Updated 2026-01-15 | Assigner mitre

References

github.com/InvoicePlane/InvoicePlane

www.helx.io/blog/advisory-invoice-plane/

cve.org (CVE-2025-67083)

nvd.nist.gov (CVE-2025-67083)

Download JSON