CVE-2025-67084: 
NixOS vulnerability analysis and mitigation

CVE-2025-67084 is a file upload vulnerability in InvoicePlane, a self-hosted open-source invoicing application, that allows authenticated attackers to upload arbitrary PHP files through the attachment functionality and execute them remotely, resulting in Remote Code Execution (RCE). It affects InvoicePlane versions through 1.6.3 (all versions prior to 1.6.4). The CVE was published on January 15, 2026, and received an initial CVSS 3.1 score of 6.5 before CISA-ADP revised it upward to 9.9 (Critical) on January 21, 2026 (Red Hat CVE, Helx Advisory).

The root cause is classified as CWE-616 (Incomplete Identification of Uploaded File Variables in PHP), meaning the application fails to adequately validate or restrict the type of files uploaded through its attachment feature (Red Hat CVE). An attacker with a valid low-privileged account can craft a multipart file upload request to submit a PHP web shell disguised as an attachment; because the server does not enforce file type restrictions, the PHP file is stored in a web-accessible directory and can subsequently be requested via HTTP to trigger server-side execution. The attack requires no user interaction and has a changed scope, meaning successful exploitation can affect resources beyond the vulnerable component itself. A public proof-of-concept advisory detailing the exploitation mechanics is available from Helx (Helx Advisory).

Successful exploitation grants an authenticated attacker full Remote Code Execution on the underlying server, enabling complete compromise of the InvoicePlane application and its host system. An attacker can access, exfiltrate, or modify sensitive financial and business data (invoices, client records, payment information), alter application records, install persistent backdoors, and use the compromised server as a pivot point for lateral movement within the internal network (Helx Advisory, Red Hat CVE). The CVSS scope is rated as "Changed," reflecting the potential for impact beyond the vulnerable application boundary.

A public proof-of-concept exploit is available via the Helx security advisory, which was added as a reference by NVD on January 22, 2026 (Helx Advisory). As of the time of reporting, there is no confirmed evidence of active in-the-wild exploitation, and no threat actor attribution has been made. The EPSS score is approximately 0.042% (0.000420), indicating a currently low but non-zero probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog at this time.

1. Reconnaissance: Identify internet-facing InvoicePlane instances running version 1.6.3 or earlier using search engines (Shodan, Censys) or by checking the application's version disclosure on the login or setup page.
2. Obtain credentials: Acquire valid low-privileged user credentials through phishing, credential stuffing, or use of default/weak credentials on the target instance.
3. Authenticate: Log in to the InvoicePlane web interface with the obtained credentials.
4. Upload malicious PHP file: Navigate to a feature that supports file attachments (e.g., invoice or client attachments). Craft a multipart HTTP POST request to upload a PHP web shell (e.g., shell.php containing <?php system($_GET['cmd']); ?>) as an attachment, bypassing any client-side file type restrictions.
5. Locate the uploaded file: Identify the web-accessible path where attachments are stored (typically under the uploads/ directory based on the application's structure).
6. Execute remote code: Send an HTTP GET request to the uploaded PHP file's URL with a command parameter (e.g., https://target/uploads/shell.php?cmd=id) to achieve arbitrary OS command execution on the server (Helx Advisory).

• Network: Unusual HTTP POST requests to attachment upload endpoints containing PHP file content or .php extensions in the filename field; subsequent GET requests to files under the uploads/ directory with query parameters resembling command injection (e.g., ?cmd=, ?exec=).
• File System: Unexpected .php files present in the uploads/ or attachment storage directories of the InvoicePlane installation; web shell files with names mimicking legitimate attachments (e.g., invoice_attachment.php).
• Logs: Web server access logs showing POST requests to upload endpoints followed by GET requests to PHP files in the uploads directory from the same or different IP addresses; PHP error logs showing execution of system commands or unusual function calls (system, exec, passthru, shell_exec).
• Process: Unusual child processes spawned by the PHP-FPM or web server process (e.g., bash, sh, curl, wget, python) with command-line arguments indicating reconnaissance or data exfiltration.

The primary remediation is to upgrade InvoicePlane to version 1.6.4 or later, which addresses the file upload restriction issue; version 1.7.0 and subsequent releases (including 1.7.1) include additional security hardening such as blocking PHP and SVG file uploads (InvoicePlane GitHub). If an immediate upgrade is not possible, administrators should restrict access to InvoicePlane to trusted users only, disable or restrict the file attachment upload feature, configure the web server to deny PHP execution within the uploads directory (e.g., via .htaccess or server configuration), and store uploaded files outside the web root. Network segmentation and monitoring of uploaded files and web server logs for suspicious PHP file activity are also recommended interim measures (Red Hat CVE).

Red Hat published a CVE tracking page for CVE-2025-67084, and CISA-ADP significantly revised the CVSS score upward from 6.5 to 9.9 Critical, reflecting the severity of the RCE potential (Red Hat CVE). The InvoicePlane project responded by releasing version 1.7.0 with multiple security fixes and publishing detailed security advisory documents in their GitHub repository, including SECURITY_ADVISORY_RCE_FIX.md (InvoicePlane GitHub). No significant broader media coverage or notable researcher commentary beyond the Helx advisory has been identified.