CVE-2026-23491: InvoicePlane has Unauthenticated Path Traversal in Guest Controller
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A path traversal vulnerability exists in the getfile method of the Guest module's Get controller in InvoicePlane up to and including through 1.6.3. The vulnerability allows unauthenticated attackers to read arbitrary files on the server by manipulating the input filename. This leads to the disclosure of sensitive information, including configuration files with database credentials. Version 1.6.4 fixes the issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23491?
CVE-2026-23491 is classified as a high-severity vulnerability due to its ability to allow unauthorized file access.
How do I fix CVE-2026-23491?
To fix CVE-2026-23491, upgrade InvoicePlane to version 1.6.4 or later, where the vulnerability has been patched.
What type of vulnerability is CVE-2026-23491?
CVE-2026-23491 is a path traversal vulnerability found in the `get_file` method of the Guest module's Get controller.
Who is affected by CVE-2026-23491?
Users of InvoicePlane versions up to and including 1.6.3 are affected by CVE-2026-23491.
Can CVE-2026-23491 be exploited remotely?
Yes, CVE-2026-23491 can be exploited remotely by unauthenticated attackers to access sensitive files on the server.