CVE-2025-67084 | THREATINT

Description

File upload vulnerability in InvoicePlane through 1.6.3 allows authenticated attackers to upload arbitrary PHP files into attachments, which can later be executed remotely, leading to Remote Code Execution (RCE).

PUBLISHED Reserved 2025-12-08 | Published 2026-01-15 | Updated 2026-01-22 | Assigner mitre

References

github.com/InvoicePlane/InvoicePlane

www.helx.io/blog/advisory-invoice-plane/

cve.org (CVE-2025-67084)

nvd.nist.gov (CVE-2025-67084)

Download JSON