CVE-2026-23491
Path Traversal in InvoicePlane Guest Module Allows Data Disclosure
Publication date: 2026-02-18
Last updated on: 2026-02-20
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| invoiceplane | invoiceplane | to 1.6.4 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-22 | The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': "CVE-2026-23491 is a critical path traversal vulnerability in InvoicePlane versions up to and including 1.6.3. It exists in the `get_file` method of the Guest module's Get controller, where the application accepts a filename parameter from the URL without properly sanitizing it. This allows unauthenticated attackers to manipulate the filename input to traverse directories and read arbitrary files on the server."}, {'type': 'paragraph', 'content': "Specifically, the method applies `urldecode()` to the filename but does not prevent directory traversal sequences like `../`. The unsanitized input is concatenated with a base directory path and passed to PHP's `readfile()` function, enabling attackers to access sensitive files outside the intended directory, such as configuration files containing database credentials and encryption keys."}, {'type': 'paragraph', 'content': "This vulnerability is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'). It was fixed in InvoicePlane version 1.6.4."}] [1]
How can this vulnerability impact me? :
This vulnerability allows unauthenticated attackers to read arbitrary files on the server hosting InvoicePlane. As a result, sensitive information such as configuration files, database credentials, and encryption keys can be disclosed.
The impact is critical because attackers can gain access to confidential data without any authentication or user interaction, potentially leading to further compromise of the system or data breaches.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': "This vulnerability can be detected by attempting to exploit the path traversal flaw in the `get_file` method of the Guest module's Get controller in InvoicePlane. Since the vulnerability allows reading arbitrary files by manipulating the filename parameter, you can test it by sending crafted HTTP requests to the vulnerable endpoint."}, {'type': 'paragraph', 'content': 'A common method is to use cURL to request files outside the intended directory, for example, trying to read sensitive files like configuration files containing database credentials.'}, {'type': 'paragraph', 'content': 'Example command to test the vulnerability using cURL:'}, {'type': 'list_item', 'content': 'curl -v "http://<target>/index.php/guest/get_file/../../ipconfig.php"'}, {'type': 'paragraph', 'content': 'Replace `<target>` with the actual server address. If the response contains the contents of the requested file, the system is vulnerable.'}] [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate and recommended mitigation is to upgrade InvoicePlane to version 1.6.4 or later, where this path traversal vulnerability has been fixed.
Until the upgrade can be performed, consider restricting access to the vulnerable endpoint by implementing network-level controls such as firewall rules or web application firewall (WAF) rules to block malicious requests attempting directory traversal sequences.
Additionally, monitor server logs for suspicious requests containing directory traversal patterns like `../` and respond accordingly.