Invoiceplane: Incomplete Identification of Uploaded File Variables (PHP)
CVE-2025-67084 is a critical-severity incomplete identification of uploaded file variables (PHP) vulnerability in Invoiceplane, with a CVSS 3.1 base score of 9.9 out of 10. It can be exploited remotely over the network by an attacker with a low-privileged account, without any action from a user. The record lists version 1.6.4 as the first without the flaw, so updating Invoiceplane to that release or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.44% chance of exploitation within 30 days, which is low compared with other CVEs.
Critical severity: a successful attack would have severe impact.
What to do
- Update Invoiceplane to 1.6.4 or a later version.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Invoiceplane | Invoiceplane | before 1.6.4 | 1.6.4 |
Version data comes from NVD's product matching. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- NetworkCan be exploited remotely over a network, including the internet.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- LowA basic user account is enough.
- User interaction
- NoneNo action by a victim is required.
- Scope
- ChangedThe attack can reach beyond the vulnerable component into other systems.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- HighData or code can be modified at will.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. Scored by CISA (ADP).
Official description
File upload vulnerability in InvoicePlane through 1.6.3 allows authenticated attackers to upload arbitrary PHP files into attachments, which can later be executed remotely, leading to Remote Code Execution (RCE).
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Incomplete Identification of Uploaded File Variables (PHP)
The PHP application uses an old method for processing uploaded files by referencing the four global variables that are set for each file (e.g. $varname, $varname_size, $varname_name, $varname_type).
How developers prevent this class of flaw
- If you must support older PHP versions, write your own version of is_uploaded_file() and run it against $HTTP_POST_FILES['userfile']))
- For later PHP versions, reference uploaded files using the $HTTP_POST_FILES or $_FILES variables, and use is_uploaded_file() or move_uploaded_file() to ensure that you are dealing with an uploaded file.
More Incomplete Identification of Uploaded File Variables (PHP) vulnerabilities (CWE-616)
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: poc, automatable: no, technical impact: partial).
- Record last changed materially (score, affected products, status or references).
References
Technical write-ups (may include proof of concept)
- helx.io/blog/advisory-invoice-plane/Exploit, Third Party Advisory
Other references
Other vulnerabilities in Invoiceplane
- 7.0 High severity
- 8.7 High severity
- 7.5 High severity
- 7.5 High severity
- 7.5 High severity
- 9.1 Critical severity
Recent Incomplete Identification of Uploaded File Variables (PHP) vulnerabilities
- 9.8 Critical severity
Spotted an error? Tell us.