CVE-2021-29024: Invoiceplane

High severity, CVSS 7.5. EPSS: 1.6% chance of exploitation in the next 30 days.

In InvoicePlane 1.5.11 a misconfigured web server allows unauthenticated directory listing and file download. Allowing an attacker to directory traversal and download files suppose to be private without authentication.

Affected products

• Invoiceplane Invoiceplane: version 1.5.11 only

Published 2021-05-17. Last modified 2026-07-29.