A vulnerability was found in InvoicePlane up to 1.6.1. It has been declared as critical. This vulnerability affects the function
upload_file of the file /index.php/upload/upload_file/1/1. The manipulation of the argument file leads to unrestricted upload.
This vulnerability was named CVE-2024-12478. The attack can be initiated remotely. Furthermore, there is an exploit available.
The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
It is recommended to upgrade the affected component.
The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
