Crater-invoice vulnerabilities
We track 3 vulnerabilities in Crater-invoice products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on August 25, 2026.
Latest Crater-invoice vulnerabilities
- 8.8 High severity
crater: Improper Limitation of a Pathname to a Restricted Directory
Crater Invoice through 6.0.6 contains a path traversal vulnerability in the self-update API that allows authenticated company owners to write arbitrary files outside the intended extraction directory by supplying crafted ZIP archives with ../ sequences to the
- 8.3 High severity
crater: Authorization Bypass Through User-Controlled Key
Crater's NotePolicy checks only a blanket Bouncer ability (manage-all-notes / view-all-notes) with no company-ownership comparison, unlike InvoicePolicy and other sibling policies which additionally verify ->hasCompany(->company_id). Any authenticated user of
- 8.3 High severity
Crater: Authorization Bypass Through User-Controlled Key
Crater isolates data per company_id, and its Invoice/Estimate/Payment/Expense policies enforce both a Bouncer ability check and ->hasCompany(->company_id). CustomerPolicy's view/update/delete methods omit the company-ownership check entirely, checking only the