CVE-2026-23491— InvoicePlane has Unauthenticated Path Traversal in Guest Controller
Quick assessment
Affected
InvoicePlane InvoicePlane
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
InvoicePlane是InvoicePlane开源的一个应用软件。提供一个自托管的开源应用程序，用于管理您的报价，发票，客户和付款。 InvoicePlane 1.6.3及之前版本存在路径遍历漏洞，该漏洞源于Guest模块Get控制器中的get_file方法存在路径遍历，可能导致读取任意文件。
Public Exploits 1
Nuclei · 1
CVE-2026-23491.yaml [template]
Possible ATT&CK Techniques 1 AI
T1530 · Data from Cloud Storage
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-23491
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
InvoicePlane has Unauthenticated Path Traversal in Guest Controller
Source: CVE Program / CVE List V5
Vulnerability Description
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A path traversal vulnerability exists in the `get_file` method of the `Guest` module's `Get` controller in InvoicePlane up to and including through 1.6.3. The vulnerability allows unauthenticated attackers to read arbitrary files on the server by manipulating the input filename. This leads to the disclosure of sensitive information, including configuration files with database credentials. Version 1.6.4 fixes the issue.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5
Vulnerability Title
InvoicePlane 路径遍历漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
InvoicePlane是InvoicePlane开源的一个应用软件。提供一个自托管的开源应用程序，用于管理您的报价，发票，客户和付款。 InvoicePlane 1.6.3及之前版本存在路径遍历漏洞，该漏洞源于Guest模块Get控制器中的get_file方法存在路径遍历，可能导致读取任意文件。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| InvoicePlane | InvoicePlane | < 1.6.4 | - |
|
II. Public POCs for CVE-2026-23491
| # | POC Description | Source Link | Shenlong Link |
|---|---|---|---|
| 1 | InvoicePlane through 1.6.3 is vulnerable to an unauthenticated path traversal in the guest "Get::get_file()" controller. The supplied filename is passed to readfile() after a single urldecode() with no directory-traversal validation, allowing an unauthenticated attacker to read files outside the customer-files upload directory - including the application's own "ipconfig.php", which discloses the database credentials and the application ENCRYPTION_KEY. Fixed in 1.6.4 by the validate_file_access() helper. | https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-23491.yaml | POC Details |
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-23491
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-23491 (1)
-
v164 to master (#1386) · InvoicePlane/InvoicePlane@add8bb7 · GitHub x_refsource_MISC
Same Patch Batch · InvoicePlane · 2026-02-18 · 11 CVEs total
| CVE-2026-25548 | 9.1 CRITICAL | InvoicePlane Vulnerable to Remote Code Execution via Local File Inclusion and Log Poisonin |
| CVE-2026-24746 | 5.7 MEDIUM | InvoicePlane has a Stored Cross-Site Scripting (XSS) issue |
| CVE-2026-24744 | 5.7 MEDIUM | InvoicePlane has a Stored Cross-Site Scripting (XSS) issue |
| CVE-2026-24745 | 5.7 MEDIUM | InvoicePlane has a Stored Cross-Site Scripting (XSS) issue |
| CVE-2026-24743 | 5.7 MEDIUM | InvoicePlane has a Stored Cross-Site Scripting (XSS) issue |
| CVE-2026-26270 | 5.4 MEDIUM | InvoicePlane has Stored Cross-Site Scripting Issue in Identifier Formatting |
| CVE-2026-25594 | 4.8 MEDIUM | InvoicePlane has Stored XSS via Family Name in Product Form |
| CVE-2026-25596 | 4.8 MEDIUM | InvoicePlane has Stored XSS via Product Unit Name in Invoice Item List |
| CVE-2026-25595 | 4.8 MEDIUM | InvoicePlane has Stored XSS via Invoice Number in Invoice View and Dashboard |
| CVE-2026-26281 | 4.4 MEDIUM | InvoicePlane has Stored Cross-Site Scripting (XSS) Issue in Sumex Invoice View |
IV. Related Vulnerabilities
Same product: InvoicePlane
-
CVE-2026-100392
InvoicePlane: Primary Administrator Privilege Downgrade via -
CVE-2026-100371
InvoicePlane: Incomplete Authorization Remediation in Users: -
CVE-2026-88003
InvoicePlane: Failure to Revoke Administrative Privileges A -
CVE-2026-49850
InvoicePlane: Missing CSRF Protection on State-Changing dele -
CVE-2026-50547
InvoicePlane permits local file inclusion through the e-invo
Same vendor: InvoicePlane
-
CVE-2026-100392
InvoicePlane: Primary Administrator Privilege Downgrade via -
CVE-2026-100371
InvoicePlane: Incomplete Authorization Remediation in Users: -
CVE-2026-88003
InvoicePlane: Failure to Revoke Administrative Privileges A -
CVE-2026-49850
InvoicePlane: Missing CSRF Protection on State-Changing dele -
CVE-2026-50547
InvoicePlane permits local file inclusion through the e-invo
Same weakness: CWE-22
-
CVE-2026-108940
EricLBuehler Mistral.rs handlers.rs calibration_apply path t -
CVE-2026-102627
Security Vulnerability identified in IBM TRIRIGA - Zip Slip -
CVE-2026-75061
IBM Planning Analytics Local is affected by security vulnera -
CVE-2026-19627
IBM Planning Analytics Local is affected by security vulnera -
CVE-2026-82101
DataStage on Cloud Pak for Data Path Traversal
V. Comments for CVE-2026-23491
No comments yet