How severe is CVE-2025-67084?

CVE-2025-67084 has a CVSS 3.x base score of 9.9, rated critical severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2025-67084 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (32nd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2025-67084?

CVE-2025-67084 affects Invoiceplane. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2025-67084?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

Does CVE-2025-67084 have an EU (EUVD) identifier?

Yes. CVE-2025-67084 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-2785.

When was CVE-2025-67084 published?

CVE-2025-67084 was published on 2026-01-15 and last updated on 2026-06-17.

CVE-2025-67084

CVE-2025-67084 is a critical-severity vulnerability in Invoiceplane with a CVSS 3.x base score of 9.9. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-616.

Key facts

Severity: Critical (CVSS 3.x base score 9.9)
EPSS exploit prediction: 0% (32nd percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-2785
Weakness: CWE-616
Affected product: Invoiceplane
Published: 2026-01-15
Last modified: 2026-06-17

Description

File upload vulnerability in InvoicePlane through 1.6.3 allows authenticated attackers to upload arbitrary PHP files into attachments, which can later be executed remotely, leading to Remote Code Execution (RCE).

Frequently asked questions

What is CVE-2025-67084?: File upload vulnerability in InvoicePlane through 1.6.3 allows authenticated attackers to upload arbitrary PHP files into attachments, which can later be executed remotely, leading to Remote Code Execution (RCE).
How severe is CVE-2025-67084?: CVE-2025-67084 has a CVSS 3.x base score of 9.9, rated critical severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2025-67084 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (32nd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2025-67084?: CVE-2025-67084 affects Invoiceplane. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2025-67084?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
Does CVE-2025-67084 have an EU (EUVD) identifier?: Yes. CVE-2025-67084 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-2785.
When was CVE-2025-67084 published?: CVE-2025-67084 was published on 2026-01-15 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:invoiceplane:invoiceplane:*:*:*:*:*:*:*:*

More vulnerabilities in Invoiceplane

CVE-2024-56975 — Critical (CVSS 9.8): InvoicePlane (all versions tested as of December 2024) v.1.6.11 and before contains a remote code execution…
CVE-2026-25548 — Critical (CVSS 9.1): InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A critical Remote…
CVE-2017-1000238 — High (CVSS 8.8): InvoicePlane version 1.4.10 is vulnerable to a Arbitrary File Upload resulting in an authenticated user can upload a…
CVE-2026-23491 — High (CVSS 7.5): InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A path traversal…
CVE-2021-29024 — High (CVSS 7.5): In InvoicePlane 1.5.11 a misconfigured web server allows unauthenticated directory listing and file download. Allowing…
CVE-2025-67082 — Medium (CVSS 6.5): An SQL injection vulnerability in InvoicePlane through 1.6.3 has been identified in "maxQuantity" and "minQuantity"…

All CVEs affecting Invoiceplane →

Other CWE-616 vulnerabilities

CVE-2024-31601 — Critical (CVSS 9.8): An issue in Beijing Panabit Network Software Co., Ltd Panalog big data analysis platform v. 20240323 and before allows…
CVE-2024-29858 — Critical (CVSS 9.8): In MISP before 2.4.187, __uploadLogo in app/Controller/OrganisationsController.php does not properly check for a valid…
CVE-2024-52305 — Medium (CVSS 6.5): UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework. A vulnerability…
CVE-2025-59402 — Medium (CVSS 5.4): Flock Safety Bravo Edge AI Compute Device BRAVO_00.00_local_20241017 accepts the default Thundercomm TurboX 6490…
CVE-2025-52130 — Medium (CVSS 5.4): File upload vulnerability in WebErpMesv2 1.17 in the app/Http/Controllers/FactoryController.php controller. This flaw…

Browse all CWE-616 vulnerabilities →