What is the CVSS score of CVE-2026-23491?

CVE-2026-23491 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Which versions of Invoiceplane are affected by CVE-2026-23491?

InvoicePlane installations are exposed to unauthorized file access through a path traversal vulnerability affecting versions up to 1.6.3.. A patch is available.

Is there a public PoC exploit available for CVE-2026-23491?

Yes, a public proof-of-concept exploit is available for CVE-2026-23491. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-23491?

Within 24 hours: Inventory all InvoicePlane instances and their versions; disable guest file access if operationally feasible. Within 7 days: Apply the available security patch to all affected systems and validate successful deployment. Within 30 days: Conduct file access audit to detect potential unauthorized downloads and review access logs for suspicious activity.

Invoiceplane CVE-2026-23491

HIGH

Path Traversal (CWE-22)

2026-02-18 security-advisories@github.com

Path Traversal Invoiceplane

7.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

PoC Detected

Feb 25, 2026 - 17:25 vuln.today

Public exploit code

Patch released

Feb 25, 2026 - 17:25 nvd

Patch available

CVE Published

Feb 18, 2026 - 20:18 nvd

HIGH 7.5

DescriptionGitHub Advisory

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A path traversal vulnerability exists in the get_file method of the Guest module's Get controller in InvoicePlane up to and including through 1.6.3. The vulnerability allows unauthenticated attackers to read arbitrary files on the server by manipulating the input filename. This leads to the disclosure of sensitive information, including configuration files with database credentials. Version 1.6.4 fixes the issue.

AnalysisAI

Unauthenticated attackers can read arbitrary files from InvoicePlane servers through path traversal in the Guest controller's file retrieval function, potentially exposing database credentials and other sensitive configuration data. This vulnerability affects InvoicePlane versions up to 1.6.3 and has public exploit code available. Version 1.6.4 resolves the issue.

Technical ContextAI

Classified as CWE-22 (Path Traversal). Affects Invoiceplane. InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A path traversal vulnerability exists in the get_file method of the Guest module's Get controller in InvoicePlane up to and including through 1.6.3. The vulnerability allows unauthenticated attackers to read arbitrary files on the server by manipulating the input filename. This leads to the disclosure of sensitive information, including configuration files with database credentials. Version

RemediationAI

A vendor patch is available — apply it immediately. Validate and sanitize file path inputs. Use allowlists. Restrict network access to the affected service where possible.