by Kastro
Paper/Archive/CVE-2026-39353

CVE-2026-39353

InvoicePlane InvoicePlane — InvoicePlane: Remote Code Execution via Writable Templates Directory

EPSS 0.4%public exploitCVSS 9.1
critical.is priorityof 100
45
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 39.0.390 × 207.8Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2-rc-1, InvoicePlane builds its permitted template list by scanning a PHP template directory that can be written through an administrator-controlled file-write capability. A malicious PHP file placed in the directory is automatically trusted by Mdl_templates and can be selected as public_invoice_template. When a public invoice is rendered, the guest View controller includes the trusted file and executes it with web-server privileges. This issue is fixed in version 1.7.2-rc-1.

Affected

ProductAffectedFixed inSource
InvoicePlane< 1.7.2-rc-1–CNA

Scores by source

GitHub_M (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

exploitgithub.com/InvoicePlane/InvoicePlane/security/advisories/GHSA-v735-2x3r-gwpprefgithub.com/InvoicePlane/InvoicePlane/pull/1536refgithub.com/InvoicePlane/InvoicePlane/commit/00e599db25804024eb323cfb751349bf3b1d8e8arefgithub.com/InvoicePlane/InvoicePlane/releases/tag/v1.7.2-rc-1