CVE-2025-67084

Critical · 9.9

CVSS

9.9

EPSS

0.4%

Published

Jan 15, 2026

CISA due date

—

The record

File upload vulnerability in InvoicePlane through 1.6.3 allows authenticated attackers to upload arbitrary PHP files into attachments, which can later be executed remotely, leading to Remote Code Execution (RCE).

Affected packages

Ecosystem	Package	Introduced	Fixed