critical9.9
CVE-2025-67084
File upload vulnerability in InvoicePlane through 1.6.3 allows authenticated attackers to upload arbitrary PHP files into attachments, which can later be execu…
Impact
File upload vulnerability in InvoicePlane through 1.6.3 allows authenticated attackers to upload arbitrary PHP files into attachments, which can later be executed remotely, leading to Remote Code Execution (RCE).
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Invoiceplane | Invoiceplane | before 1.6.4 |