CVE-2026-23491

InvoicePlane has Unauthenticated Path Traversal in Guest Controller

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A path traversal vulnerability exists in the `get_file` method of the `Guest` module's `Get` controller in InvoicePlane up to and including through 1.6.3. The vulnerability allows unauthenticated attackers to read arbitrary files on the server by manipulating the input filename. This leads to the disclosure of sensitive information, including configuration files with database credentials. Version 1.6.4 fixes the issue.

Affected

InvoicePlane

CVSS v4.0 GITHUB

9.3 CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1 NVD

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

4.57% chance of exploitation in the next 30 days, 92nd percentile

Nuclei

high · CWE-22

Published

2026-02-18

Updated

2026-02-25

Proof-of-concept exploits (1)

• lukasz-rybak/CVE-2026-234910★ · 2026-04-11

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-23491.yaml

Security advisories

• InvoicePlane/InvoicePlane/security/advisories/GHSA-88gq-mv54-v3fc
• InvoicePlane/InvoicePlane/commit/add8bb798dde621f886823065ef1841986543c69

References

• CVE Record
• NVD entry

Related

• CVE-2026-1434
• CVE-2026-21857
• CVE-2026-22243
• CVE-2026-22692
• CVE-2026-22849
• CVE-2026-23498