CVE-2026-23491

The vulnerability results from the lack of proper validation of the file name passed to the `get_file` method in the module handled by unauthenticated users (the `Guest` module). By manipulating the input parameter of the file name — for example, using `../` sequences — an attacker can escape the allowed directory and point to any file in the server's file system. Since the vulnerable endpoint is accessible without authentication, the exploit does not require possessing any credentials or permissions in the application.

An attacker can read arbitrary files on the server, including configuration files containing database credentials, which can lead to further infrastructure compromise. In case of credential leakage, it is possible to escalate the attack to other system components.

InvoicePlane should be updated to version 1.6.4, which contains a patch eliminating the vulnerability. Patch details are available in the project repository on GitHub (commit add8bb798dde621f886823065ef1841986543c69).

InvoicePlane versions up to and including 1.6.3