CVE-2021-29022: 
NixOS vulnerability analysis and mitigation

InvoicePlane version 1.5.11 contains a full path disclosure vulnerability in the upload feature. The vulnerability was discovered on March 17, 2021, and is tracked as CVE-2021-29022. This security issue affects the file upload functionality of InvoicePlane CRM, where the system discloses the complete path of the file upload directory (Security Research).

The vulnerability is classified under CWE-434 (Unrestricted Upload of File with Dangerous Type) and has been assigned a CVSS v3.1 Base Score of 5.3 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. The issue specifically occurs in the /upload/show_files/ path, which reveals the full path of uploaded files, even when custom installation paths are configured via the UPLOADS_FOLDER constant in index.php (NVD).

The vulnerability exposes sensitive server information by disclosing the full path of the file upload directory. This information disclosure could potentially be leveraged by attackers to gain deeper understanding of the server's file system structure and potentially aid in further attacks (Security Research).

The vulnerability can be exploited remotely without requiring authentication or user interaction. The attack vector is network-accessible, and the complexity of exploitation is considered low according to the CVSS metrics (NVD).

While specific patch information is not directly provided in the available sources, users should consider upgrading to a version newer than 1.5.11 if available. Additionally, administrators can implement web server configurations to restrict access to the /upload/show_files/ path (Security Research).