CVE-2025-67083: 
NixOS vulnerability analysis and mitigation

CVE-2025-67083 is a directory traversal (path traversal) vulnerability in InvoicePlane, a self-hosted open-source invoicing application, affecting all versions through 1.6.3. The flaw allows unauthenticated remote attackers to read arbitrary files from the server; the scope of readable files depends on the web server and its configuration. It was published on January 15, 2026, and carries a CVSS v3.1 base score of 5.3 (Medium) (Feedly, Helx Advisory).

The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory — Path Traversal), meaning the application fails to properly sanitize user-supplied input used in file system path construction, allowing attackers to escape the intended directory (Feedly). An unauthenticated attacker can craft HTTP requests containing path traversal sequences (e.g., ../) to reference files outside the web root, potentially accessing sensitive configuration files, credentials, or other server-side resources. No authentication or special privileges are required, and no user interaction is needed, making this exploitable remotely with low complexity. A public advisory with technical details is available from the discovering researcher (Helx Advisory).

Successful exploitation allows an unauthenticated attacker to read arbitrary files from the server, with the specific files accessible depending on the web server's configuration and the permissions of the process running InvoicePlane. Sensitive files such as ipconfig.php (containing database credentials and encryption keys), application logs, or system files (e.g., /etc/passwd) could be exposed, leading to credential theft and potential further compromise of the database or broader infrastructure. The vulnerability has no direct integrity or availability impact, but confidentiality loss could enable lateral movement or privilege escalation (Feedly, Helx Advisory).

A public exploit/advisory is available from Helx.io, referenced by NVD as an exploit and third-party advisory (Helx Advisory). The EPSS score is approximately 0.09%, indicating a currently low probability of widespread exploitation. No evidence of active in-the-wild exploitation or threat actor attribution has been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The low attack complexity and lack of authentication requirements make it straightforward to exploit if a public-facing InvoicePlane instance is identified.

1. Reconnaissance: Identify internet-facing InvoicePlane instances (versions ≤ 1.6.3) using search engines like Shodan or Censys, or by fingerprinting the application via its default login page or HTTP headers.
2. Craft traversal payload: Construct an HTTP GET request targeting a vulnerable endpoint that accepts a file path parameter, embedding path traversal sequences such as ../../ or URL-encoded equivalents (%2e%2e%2f) to escape the web root.
3. Target sensitive files: Attempt to read high-value files such as ipconfig.php (database credentials, encryption key), application configuration files, or OS-level files like /etc/passwd, depending on server permissions.
4. Extract credentials: Parse the retrieved file contents for database connection strings, encryption keys, or other credentials that could enable further access to the database or application.
5. Escalate access: Use harvested credentials to authenticate to the database directly, access the InvoicePlane admin panel, or pivot to other systems on the network (Helx Advisory).

• Network: Unusual HTTP GET requests to InvoicePlane endpoints containing path traversal sequences such as ../, %2e%2e%2f, or %2e%2e/ in URL parameters; requests from unexpected IP addresses targeting file-serving endpoints.
• Logs: Web server access logs (e.g., Apache/Nginx) showing requests with traversal patterns (e.g., GET /index.php/some_controller?file=../../ipconfig.php); repeated 200 OK responses to such requests from unauthenticated sessions.
• File System: No direct file system artifacts from read-only exploitation, but evidence of subsequent unauthorized database access or admin login attempts following the traversal may indicate credential harvesting.

Users should upgrade InvoicePlane to version 1.6.4 or later, which addresses this path traversal vulnerability; version 1.7.0 and above also include additional security hardening including fixes for LFI, XSS, and log poisoning issues (GitHub InvoicePlane). As a temporary workaround, restrict public access to InvoicePlane instances using firewall rules or authentication proxies, and ensure the web server process runs with minimal file system permissions to limit the scope of readable files. Review web server configuration to prevent serving sensitive files (e.g., .php config files) via direct HTTP access.

The vulnerability was discovered and publicly disclosed by Helx.io, whose advisory serves as the primary technical reference (Helx Advisory). The InvoicePlane project has acknowledged multiple security issues in recent releases and has been actively addressing them in versions 1.7.0 and later, as documented in their GitHub repository (GitHub InvoicePlane). No significant broader media coverage or notable social media discussion has been identified for this specific CVE.