PatchTheCVEinvoiceplane vulnerabilities
Recent CVEs affecting invoiceplane products. 19 tracked.
invoiceplane has 19 tracked vulnerabilities, 3 critical. A fixed release or vendor patch exists for 12. Most recent: 2026-02-18. Highest priority: CVE-2026-23491 (score 62/100).
- CVE-2025-64012 MEDIUM 4.3 DOWNGRADE InvoicePlane commit debb446c is vulnerable to Incorrect Access Control
- CVE-2026-26281 MEDIUM 4.4 DOWNGRADE InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments
- CVE-2026-26270 MEDIUM 5.4 DOWNGRADE InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments
- CVE-2026-25596 MEDIUM 4.8 UPGRADE InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments
- CVE-2026-25595 MEDIUM 4.8 UPGRADE InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments
- CVE-2026-25594 MEDIUM 4.8 UPGRADE InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments
- CVE-2026-25548 CRITICAL 9.1 UPGRADE InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments
- CVE-2026-24746 MEDIUM 5.7 DOWNGRADE InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments
- CVE-2026-24745 MEDIUM 5.7 DOWNGRADE InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments
- CVE-2026-24744 MEDIUM 5.7 DOWNGRADE InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments
- CVE-2026-24743 MEDIUM 5.7 DOWNGRADE InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments
- CVE-2026-23491 HIGH 7.5 UPGRADE InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments
- CVE-2025-67084 CRITICAL 9.9 UPGRADE File upload vulnerability in InvoicePlane through 1.6.3 allows authenticated attackers to upload arbitrary PHP
- CVE-2025-67083 MEDIUM 5.3 UPGRADE Directory traversal vulnerability in InvoicePlane through 1.6.3 allows unauthenticated attackers to read files
- CVE-2025-67082 MEDIUM 6.5 UPGRADE An SQL injection vulnerability in InvoicePlane through 1.6.3 has been identified in "maxQuantity" and "minQuan
- CVE-2024-56975 CRITICAL 9.8 UPGRADE InvoicePlane (all versions tested as of December 2024) v.1.6.11 and before contains a remote code execution vu
- CVE-2024-12667 LOW 3.7 UPGRADE A vulnerability was found in InvoicePlane up to 1.6.1 and classified as problematic
- CVE-2024-12478 MEDIUM 6.3 UPGRADE A vulnerability was found in InvoicePlane up to 1.6.1
- CVE-2024-12362 MEDIUM 4.3 UPGRADE A vulnerability was found in InvoicePlane up to 1.6.1
FAQ
How do I fix invoiceplane vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is invoiceplane being exploited right now?
None of the tracked invoiceplane CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which invoiceplane CVE should I patch first?
CVE-2026-23491 currently ranks highest (62/100): InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments.