Description
File upload vulnerability in InvoicePlane through 1.6.3 allows authenticated attackers to upload arbitrary PHP files into attachments, which can later be executed remotely, leading to Remote Code Execution (RCE).
Critical · 9.9
CVE-2025-67084
EUVD-2026-2785GHSA-jpvh-v7h3-v24c
File upload vulnerability in InvoicePlane through 1.6.3 allows authenticated attackers to upload arbitrary PHP files into attachments, whic…
Published Jan 15, 2026 · Updated Jan 22, 2026 · Assigned by mitre