InvoicePlane (all versions tested as of December 2024) v.1.6.11 and before contains a remote code execution vulnerability in the upload_file method of the Upload controller.
The vulnerability classified as CWE-434 (Unrestricted Upload of File with Dangerous Type) consists of the lack of proper verification of uploaded file types in the upload_file method of the Upload controller. An attacker can upload a malicious file (e.g., PHP script) to the server over the network without needing an account or victim interaction. After upload, the file can be executed on the server side, resulting in system takeover.
An attacker gains the ability to remotely execute arbitrary code on the server (RCE), which can lead to complete system takeover, data theft, installation of backdoors, or further lateral movement in the network.
Patches available from the vendor should be applied according to references (pull requests #1127 and #1166 in the InvoicePlane GitHub repository). Immediate update to a version containing fixes is recommended, and access to the file upload function should be restricted at the firewall or WAF level until the patch is deployed.
InvoicePlane version 1.6.11 and all earlier versions (all versions tested through December 2024)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HInvoiceplane
APPInvoiceplane< 1.6.2
Related vulnerabilities
Path traversal w InvoicePlane umożliwia odczyt dowolnych plików bez uwierzytelnienia
RCE w InvoicePlane 1.7.0 via LFI i Log Poisoning
RCE przez nieautoryzowany upload plików PHP w InvoicePlane
In InvoicePlane 1.5.11 a misconfigured web server allows unauthenticated directory listing and file download. ...
InvoicePlane version 1.4.10 is vulnerable to a Arbitrary File Upload resulting in an authenticated user can up...