InvoicePlane - Path Traversal (CVE-2026-23491)

CVE-2026-23491 is a critical path traversal vulnerability in InvoicePlane through version 1.6.3 that allows unauthenticated attackers to read arbitrary files on the server by manipulating the filename input. Exploitation can expose sensitive data, including configuration files and database credentials, potentially enabling further compromise of connected systems. InvoicePlane 1.6.4 addresses the issue.

CrowdSec has been tracking this vulnerability and its exploits since 17th of September 2026.

Insights from the CrowdSec network reveal that the attackers trying to exploit CVE-2026-23491 are composed of a fairly even mix of opportunistic and targeted actors. Some attackers employ preliminary reconnaissance, while others use indiscriminate scanning. In addition, according to the CrowdSec network, attack volume against CVE-2026-23491 has dipped slightly compared to the previous week. Although still commonly targeted, the decline suggests a cooling-off period. Long-term relevance remains, but attention is waning.

Attackers target the InvoicePlane guest file-download endpoint at /index.php/guest/get/get_file/, supplying encoded ../ traversal sequences to access files outside the intended upload directory, such as ipconfig.php. Successful exploitation may disclose application configuration, database credentials, and encryption keys in an attachment response.