InvoicePlane Remote Code Execution Vulnerability in File Upload Function

A remote code execution vulnerability has been identified in InvoicePlane versions through 1.6.11. The issue arises in the upload_file method of the Upload controller, where improper handling of file uploads allows for the execution of arbitrary code.

Impact

Exploitation of this vulnerability allows for remote code execution on the server where InvoicePlane is hosted.

Reproduction

To reproduce this vulnerability, upload a file through the application's file upload feature. The uploaded file should be crafted to include malicious code. Once the file is uploaded, the malicious code will be executed on the server.

Remediation

Users are advised to update to InvoicePlane version 1.6.2 or later, where this vulnerability has been fixed.