Unscored CVE-2021-29024 EUVD-2021-15670GHSA-q48v-hqmw-c65v

In InvoicePlane 1.5.11 a misconfigured web server allows unauthenticated directory listing and file download. Allowing an attacker to direc…

Published May 17, 2021 · Updated Jul 29, 2026 · Assigned by mitre

Description

In InvoicePlane 1.5.11 a misconfigured web server allows unauthenticated directory listing and file download. Allowing an attacker to directory traversal and download files suppose to be private without authentication.

References

https://notnnor.github.io/research/2021/03/17/files-or-directories-accessible-to-external-parties-in-invoiceplane.html
https://github.com/InvoicePlane/InvoicePlane/pull/754
https://seran.github.io/research/2021/03/17/files-or-directories-accessible-to-external-parties-in-invoiceplane.html