InvoicePlane <= 1.6.3 - Arbitrary File Read
CVE-2026-23491
Verified
Description
InvoicePlane through 1.6.3 is vulnerable to an unauthenticated path traversal in the guest "Get::get_file()" controller. The supplied filename is passed to readfile() after a single urldecode() with no directory-traversal validation, allowing an unauthenticated attacker to read files outside the customer-files upload directory - including the application's own "ipconfig.php", which discloses the database credentials and the application ENCRYPTION_KEY. Fixed in 1.6.4 by the validate_file_access() helper.
Severity
High
CVSS Score
7.5
Exploit Probability
4%
Affected Product
invoiceplane
Published Date
August 7, 2026
Template Author
str4k3r
CVE-2026-23491.yaml
7.5Score
CVSS Metrics
CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVE ID:
cve-2026-23491
CWE ID:
cwe-22