CVE-2025-67083

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-67083
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-67083.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-67083
Published
2026-01-15T00:00:00Z
Modified
2026-07-08T08:12:20.429015452Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
[none]
Details

Directory traversal vulnerability in InvoicePlane through 1.6.3 allows unauthenticated attackers to read files from the server. The ability to read files and the file type depends on the web server and its configuration.

Database specific 
{
    "cna_assigner": "mitre",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/67xxx/CVE-2025-67083.json"
}
References

Affected packages

Git / github.com/invoiceplane/invoiceplane

Affected ranges

Type
GIT
Repo
https://github.com/invoiceplane/invoiceplane
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
e229a9b748643d8507bee113e88396cbd7fe32ea
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.6.3"
        },
        {
            "fixed": "1.6.4"
        }
    ],
    "cpe": "cpe:2.3:a:invoiceplane:invoiceplane:*:*:*:*:*:*:*:*",
    "source": [
        "DESCRIPTION",
        "CPE_RANGE"
    ]
}

Affected versions

0.*
0.9beta
v1.*
v1.0.0
v1.0.1
v1.1.0
v1.2.0
v1.4.0
v1.4.1
v1.4.10
v1.4.2
v1.4.3
v1.4.4
v1.4.5
v1.4.6
v1.4.7
v1.4.8
v1.4.9
v1.5.0
v1.5.1
v1.5.10
v1.5.2
v1.5.3
v1.5.4
v1.5.5
v1.5.6
v1.5.7
v1.5.8
v1.5.9
v1.6-beta
v1.6-beta-1
v1.6-beta-2
v1.6-beta-3
v1.6.0
v1.6.1
v1.6.1-alpha-1
v1.6.1-beta-1
v1.6.1-beta-2
v1.6.1-beta-3
v1.6.2-beta-1
v1.6.2-beta-2
v1.6.2-beta-3
v1.6.3-rc0
v1.6.3-rc1
v1.6.3-rc2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-67083.json"