CVE-2025-67084
Medium
Low
Medium
High
Critical
6.5
CVSS Score
Published: Jan 15, 2026
Last Modified: Jan 15, 2026
Vulnerability Description
File upload vulnerability in InvoicePlane through 1.6.3 allows authenticated attackers to upload arbitrary PHP files into attachments, which can later be executed remotely, leading to Remote Code Execution (RCE).
CVSS Metrics
Common Vulnerability Scoring System
Vector String:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Attack Vector
N
Attack Complexity
L
Privileges Required
N
User Interaction
N
Scope
U
Confidentiality
L
Integrity
L
Availability
N
Severity Details
6.5
out of 10.0
Medium
Key Information
- Published Date
- January 15, 2026
