CVE-2025-67083

5.3 mediumEPSS 0.7%

Medium (5.3) in invoiceplane invoiceplane. EPSS 0.7% chance of exploitation in the next 30 days.

Directory traversal vulnerability in InvoicePlane through 1.6.3 allows unauthenticated attackers to read files from the server. The ability to read files and the file type depends on the web server and its configuration.

Severity

CVSS 3.1

5.3 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS: 0.7% chance of exploitation in the next 30 days; higher than 54% of CVEs (scores of 2026-10-31)
CWE: CWE-22
Published: 2026-01-15
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

invoiceplane:invoiceplane

References

https://github.com/InvoicePlane/InvoicePlane
https://www.helx.io/blog/advisory-invoice-plane/

Check your stack JSON