CVE-2026-23491: InvoicePlane Path Traversal Vulnerability

CVE-2026-23491 Overview

A path traversal vulnerability exists in the get_file method of the Guest module's Get controller in InvoicePlane, a self-hosted open source application for managing invoices, clients, and payments. The vulnerability affects InvoicePlane versions up to and including 1.6.3 and allows unauthenticated attackers to read arbitrary files on the server by manipulating the input filename parameter. This can lead to the disclosure of sensitive information, including configuration files containing database credentials.

Critical Impact

Unauthenticated attackers can exploit this path traversal flaw to read sensitive server files, including database configuration credentials, potentially leading to complete system compromise.

Affected Products

• InvoicePlane versions up to and including 1.6.3
• InvoicePlane Guest module (Get controller)
• Self-hosted InvoicePlane installations with exposed web interfaces

Discovery Timeline

• 2026-02-18 - CVE-2026-23491 published to NVD
• 2026-02-19 - Last updated in NVD database

Technical Details for CVE-2026-23491

Vulnerability Analysis

This path traversal vulnerability (CWE-22) exists in the get_file method within InvoicePlane's Guest module Get controller. The application fails to properly sanitize user-supplied filename parameters, allowing attackers to use directory traversal sequences (such as ../) to escape the intended directory and access arbitrary files on the server's filesystem.

The vulnerability is particularly severe because it requires no authentication to exploit. Any attacker with network access to the InvoicePlane installation can leverage this flaw to read sensitive files. The most critical impact is the potential exposure of configuration files containing database credentials, which could enable subsequent attacks including database compromise, data theft, or further lateral movement within the infrastructure.

Root Cause

The root cause of this vulnerability is improper input validation in the get_file method. The application does not adequately sanitize or validate the filename parameter before using it to construct file paths, allowing directory traversal sequences to bypass intended access restrictions. Without proper path canonicalization or allowlist validation, user-controlled input can be used to reference files outside the intended directory.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker can craft malicious HTTP requests to the vulnerable Guest module endpoint, supplying a filename parameter containing path traversal sequences. By using patterns such as ../../../etc/passwd or targeting application-specific configuration files, the attacker can read sensitive data from the server.

The attack flow involves:

1. Identifying an InvoicePlane installation (versions 1.6.3 or earlier)
2. Sending crafted requests to the Guest/Get/get_file endpoint
3. Including directory traversal sequences in the filename parameter
4. Retrieving sensitive files including configuration files with database credentials

// Security patch excerpt from InvoicePlane commit
 *.bak
 npm-debug.log
 yarn-error.log
+.temp

Source: GitHub Commit

Detection Methods for CVE-2026-23491

Indicators of Compromise

• HTTP requests to Guest module endpoints containing path traversal sequences (../, ..%2f, %2e%2e/)
• Unusual file access attempts targeting configuration files such as ipconfig.php or database.php
• Web server access logs showing requests with encoded directory traversal patterns
• Anomalous read operations on sensitive system files from the web server process

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block path traversal patterns in HTTP requests
• Monitor web server access logs for requests containing ../ sequences or URL-encoded equivalents
• Deploy file integrity monitoring on critical configuration files to detect unauthorized access
• Configure intrusion detection systems (IDS) with signatures for path traversal attack patterns

Monitoring Recommendations

• Enable detailed logging on InvoicePlane application and web server for forensic analysis
• Set up alerts for access attempts to files outside the expected application directory structure
• Monitor database activity for unusual connection attempts that may indicate credential theft
• Review authentication logs for potential follow-on attacks using compromised credentials

How to Mitigate CVE-2026-23491

Immediate Actions Required

• Upgrade InvoicePlane to version 1.6.4 or later immediately
• Restrict network access to InvoicePlane installations to trusted IP ranges where possible
• Review web server access logs for evidence of exploitation attempts
• Rotate database credentials and any other sensitive information that may have been exposed

Patch Information

InvoicePlane version 1.6.4 fixes this vulnerability. The security patch addresses the improper input validation in the get_file method. Organizations should upgrade to the patched version immediately.

For detailed patch information, refer to the GitHub Security Advisory GHSA-88gq-mv54-v3fc and the commit changes.

Workarounds

• Implement WAF rules to block requests containing path traversal sequences targeting InvoicePlane endpoints
• Place InvoicePlane behind a VPN or restrict access to trusted networks only
• Use web server configuration to deny access to sensitive configuration directories
• Disable or restrict access to the Guest module if guest functionality is not required

# Example Apache configuration to restrict access
<Directory /var/www/invoiceplane/application>
    # Deny access to configuration files
    <FilesMatch "\.(php|ini|conf)$">
        Require all denied
    </FilesMatch>
</Directory>

# Block path traversal patterns in mod_security
SecRule REQUEST_URI "\.\./" "id:1001,deny,status:403,msg:'Path Traversal Attempt'"