VULNERABILITY INTELLIGENCE

CVE-2025-67084

CVSS score9.9 CRITICAL
EPSS probability0.44%
CISA KEVNot currently listed
Published2026-01-15
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Description

File upload vulnerability in InvoicePlane through 1.6.3 allows authenticated attackers to upload arbitrary PHP files into attachments, which can later be executed remotely, leading to Remote Code Execution (RCE).

Weakness classification

  • 134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-616

Primary references