CVE-2025-67084

PoC —

CVSS 3.1

9.9 critical

EPSS

<1%p38

Published

Jan 15, 2026 (Jan 15, 2026)

Modified

Jun 17, 2026

Description

File upload vulnerability in InvoicePlane through 1.6.3 allows authenticated attackers to upload arbitrary PHP files into attachments, which can later be executed remotely, leading to Remote Code Execution (RCE).

Vendors: invoiceplane
Products: invoiceplane
Weakness: CWE-616
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (0.4%)

In the news0 stories

No ingested article mentions this CVE yet.