CVE-2026-23491

InvoicePlane up to version 1.6.3 is affected by a path traversal vulnerability in the Guest.Get controller’s get_file method, allowing unauthenticated attackers to read arbitrary server files (including configuration with database credentials). Root cause: improper input handling of the filename ...