HIGH🇵🇱 Wersja polska

CVE-2017-1000238

CVSS 8.8v3.0pub. 2017-11-17upd. 2026-05-13

InvoicePlane version 1.4.10 is vulnerable to a Arbitrary File Upload resulting in an authenticated user can upload a malicious file to the webserver. It is possible for an attacker to upload a script which is able to compromise the webserver.

CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

  • Invoiceplane

    APP
    Invoiceplane
    1.4.10
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2026-25548CRITICAL9.1PL ✓ten sam produkt

RCE w InvoicePlane 1.7.0 via LFI i Log Poisoning

CVE-2026-23491CRITICAL9.3PL ✓ten sam produkt

Path traversal w InvoicePlane umożliwia odczyt dowolnych plików bez uwierzytelnienia

CVE-2025-67084CRITICAL9.9PL ✓ten sam produkt

RCE przez nieautoryzowany upload plików PHP w InvoicePlane

CVE-2024-56975CRITICAL9.8PL ✓ten sam produkt

RCE w InvoicePlane — niebezpieczne przesyłanie plików (upload_file)

CVE-2021-29024HIGH7.5ten sam produkt

In InvoicePlane 1.5.11 a misconfigured web server allows unauthenticated directory listing and file download. ...