lukasz-rybak/cve-2026-23491CVE-2026-23491 - InvoicePlane has Unauthenticated Path Traversal in Guest Controller
| Field | Details |
|---|---|
| CVE ID | CVE-2026-23491 |
| Severity | CRITICAL |
| Advisory | View Advisory |
| Discovered by | Lukasz Rybak |
A path traversal vulnerability exists in the get_file method of the Guest module's Get controller in InvoicePlane v1.6.3. The vulnerability allows unauthenticated attackers to read arbitrary files on the server by manipulating the input filename. This leads to the disclosure of sensitive information, including configuration files with database credentials.
The vulnerability is located in the application/modules/guest/controllers/Get.php file, specifically within the get_file function.
The function accepts a $filename parameter directly from the URL. It performs urldecode($filename) but fails to sanitize the input for directory traversal sequences (e.g., ../). The sanitized filename is then concatenated with a base directory ($this->targetPath, which maps to uploads/customer_files/) and passed to the readfile() function.
Vulnerable Code Snippet:
public function get_file($filename): void
{
$filename = urldecode($filename);
if ( ! file_exists($this->targetPath . $filename)) {
$ref = isset($_SERVER['HTTP_REFERER']) ? ', Referer:' . $_SERVER['HTTP_REFERER'] : '';
$this->respond_message(404, 'upload_error_file_not_found', $this->targetPath . $filename . $ref);
}
// ... headers setting content type and disposition ...
readfile($this->targetPath . $filename);
}
Because $filename is user-controlled and unchecked, an attacker can provide a string like ../../ipconfig.php to break out of the intended directory.
The following cURL command demonstrates reading the ipconfig.php file (which resides two directories up from the default uploads/customer_files/ directory):
curl http://localhost/index.php/guest/get/get_file/..%2f..%2fipconfig.php
Expected Output:
The server responds with the content of ipconfig.php, which includes sensitive environment variables like DB_PASSWORD and ENCRYPTION_KEY.
Attackers can read the application configuration, source code, and potentially other files on the system readable by the web server user.
This CVE was responsibly disclosed following coordinated vulnerability disclosure practices. The information provided here is for educational and defensive purposes only.