CVE-2025-67084 | File upload vulnerability in InvoicePlane through 1.6.3 allo… | CVSS 9.9 CRITICAL

Description

File upload vulnerability in InvoicePlane through 1.6.3 allows authenticated attackers to upload arbitrary PHP files into attachments, which can later be executed remotely, leading to Remote Code Execution (RCE).

Metadata

CVE ID: CVE-2025-67084
State: PUBLISHED
Assigner: mitre
Reserved: 2025-12-08 00:00 UTC
Published: 2026-01-15 00:00 UTC
Last updated: 2026-01-22 02:57 UTC
Primary CWE: CWE-616
CWE-616 Incomplete Identification of Uploaded File Variables…
Vendor / Product: n/a / n/a
Sources: cve.org · NVD

Severity & Metrics

9.9 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: PoC
Automatable: no
Tech. Impact: partial

Affected products (1)

Vendor	Product	Platform	Versions
n/a	n/a	—	n/a

Weakness (CWE)

CWE	Source	Description
—	cna	n/a
CWE-616	adp	CWE-616 Incomplete Identification of Uploaded File Variables (PHP)

CVSS scores (1)

Score	Severity	Version	Source	Vector
9.9	CRITICAL	3.1	adp	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References (2)