CVE-2026-23491: 
NixOS vulnerability analysis and mitigation

CVE-2026-23491 is an unauthenticated path traversal vulnerability in InvoicePlane's Guest module Get controller, specifically in the get_file method. It affects all InvoicePlane versions up to and including 1.6.3, allowing unauthenticated remote attackers to read arbitrary files on the server by manipulating the filename parameter. The vulnerability was published on February 18, 2026, with a patch released in version 1.6.4. It carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 9.3 (Critical) (GitHub Advisory, Feedly).

The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). The vulnerable code resides in application/modules/guest/controllers/Get.php within the get_file function, which accepts a $filename parameter directly from the URL and applies only urldecode() without sanitizing directory traversal sequences such as ../. The decoded filename is then concatenated with the base directory (uploads/customer_files/) and passed directly to PHP's readfile() function. Because the Guest module is accessible without authentication, no login or privilege is required to trigger the vulnerability — an attacker simply crafts a URL with URL-encoded traversal sequences (e.g., ..%2f..%2f) to escape the intended directory (GitHub Advisory).

Successful exploitation allows unauthenticated remote attackers to read any file on the server that is accessible to the web server process, including sensitive configuration files such as ipconfig.php, which contains database credentials (DB_PASSWORD) and encryption keys (ENCRYPTION_KEY). Disclosure of these credentials could enable an attacker to access the underlying database, escalate privileges, or pivot to other systems within the infrastructure. There is no direct integrity or availability impact on the vulnerable system itself, but the subsequent system impact is rated High across confidentiality, integrity, and availability due to the potential for full infrastructure compromise following credential theft (GitHub Advisory, Feedly).

As of the time of reporting, there is no evidence of a public proof-of-concept exploit or active in-the-wild exploitation (Feedly). However, the GitHub Security Advisory includes a working PoC curl command demonstrating the attack, making exploitation trivial for any attacker who reviews the advisory (GitHub Advisory). The EPSS score is 0.00177 (approximately 0.18%), indicating a currently low but non-negligible probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Reconnaissance: Identify internet-facing InvoicePlane instances running version 1.6.3 or earlier using search engines (e.g., Shodan, Censys) or by checking the application's version disclosure in page source or HTTP headers.
2. Identify the vulnerable endpoint: The Guest module's Get controller is publicly accessible without authentication at the path /index.php/guest/get/get_file/<filename>.
3. Craft a path traversal payload: Construct a filename parameter using URL-encoded directory traversal sequences to escape the uploads/customer_files/ base directory. For example, to reach ipconfig.php two directories up: ..%2f..%2fipconfig.php.
4. Send the malicious request: Execute the request using a tool such as curl:

   curl http://<target>/index.php/guest/get/get_file/..%2f..%2fipconfig.php

5. Retrieve sensitive data: The server responds with the raw contents of the targeted file. For ipconfig.php, this includes environment variables such as DB_PASSWORD, ENCRYPTION_KEY, and database connection details.
6. Leverage credentials: Use the extracted database credentials to connect directly to the database server, enabling further data exfiltration, privilege escalation, or lateral movement within the infrastructure (GitHub Advisory).

• Network: Unusual HTTP GET requests to /index.php/guest/get/get_file/ containing URL-encoded traversal sequences such as %2f, %2e%2e, or literal ../ in the filename parameter; requests targeting files outside the uploads/customer_files/ directory (e.g., ipconfig.php, .env, config.php).
• Logs: Web server access logs showing requests to the guest/get/get_file endpoint with anomalous filename values; HTTP 200 responses to requests containing traversal patterns; repeated probing of the endpoint from a single IP address.
• File System: No direct file system artifacts are expected from read-only exploitation; however, if credentials obtained are used for database access, look for unexpected database login events from external IPs.
• Process: No unusual process spawning is expected from this read-only vulnerability, but subsequent exploitation using harvested credentials may produce anomalous database client connections or new administrative sessions (GitHub Advisory).

The primary remediation is to upgrade InvoicePlane to version 1.6.4, which fixes the path traversal vulnerability by properly sanitizing the $filename parameter in the get_file method to prevent directory traversal sequences (GitHub Advisory, GitHub Commit). For organizations unable to patch immediately, the following interim mitigations are recommended:

• Implement network-level access controls (firewall rules, IP allowlisting) to restrict access to the InvoicePlane application.
• Deploy Web Application Firewall (WAF) rules to detect and block requests containing path traversal patterns (e.g., ../, %2f, %2e%2e) targeting the guest/get/get_file endpoint.
• Monitor web server access logs for suspicious requests to the affected endpoint.
• Rotate database credentials and encryption keys if exposure is suspected.

The vulnerability was reported by security researcher lukasz-rybak and disclosed via the InvoicePlane GitHub Security Advisory on February 16, 2026 (GitHub Advisory). The InvoicePlane maintainer nielsdrost7 published the advisory and coordinated the fix in version 1.6.4. No significant broader media coverage or notable social media discussion has been identified beyond standard vulnerability database aggregation.