CVE-2026-39353 in InvoicePlane
Summary
by MITRE • 09/25/2026
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2-rc-1, InvoicePlane builds its permitted template list by scanning a PHP template directory that can be written through an administrator-controlled file-write capability. A malicious PHP file placed in the directory is automatically trusted by Mdl_templates and can be selected as public_invoice_template. When a public invoice is rendered, the guest View controller includes the trusted file and executes it with web-server privileges. This issue is fixed in version 1.7.2-rc-1.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/25/2026
InvoicePlane serves as an open-source solution for managing invoices, clients, and payments, relying on a modular architecture to handle various administrative and public-facing tasks. A critical security flaw exists within the template management system prior to version 1.7.2-rc-1, specifically involving how permitted templates are identified and loaded by the Mdl_templates class. The application constructs its list of allowed templates by scanning a specific PHP directory designated for storing invoice templates. This design decision introduces a significant vulnerability because the directory is writable through an administrator-controlled file-write capability that lacks sufficient validation or sanitization mechanisms to distinguish between legitimate template files and malicious code injections.
The core technical flaw stems from the absence of strict input validation when handling user-supplied filenames during the rendering process. An attacker who has gained access to a feature allowing file uploads or modifications within this specific directory can place a crafted PHP script into the location where templates are stored. Because the application automatically trusts any PHP file found in this directory as part of its permitted template list, there is no mechanism to verify that the uploaded content conforms to expected structural standards for invoice templates. This oversight allows an attacker to effectively bypass access controls by leveraging the administrative write capability to inject arbitrary code into a location that the system subsequently treats as safe and executable.
The operational impact of this vulnerability is severe, resulting in remote code execution with web-server privileges. When a public invoice is rendered, the guest View controller includes the trusted file identified during the scanning phase. Since the included file contains malicious PHP code injected by an attacker, the server executes this code immediately upon rendering the page. This process grants the attacker full control over the underlying system under the context of the web server user account, potentially leading to complete compromise of the application environment, data exfiltration, or further lateral movement within the network infrastructure. The vulnerability is classified as a path traversal and arbitrary file inclusion issue, aligning with CWE-94 Improper Control of Generation of Code (Code Injection) and CWE-200 Exposure of Sensitive Information to an Unauthorized Actor if sensitive server details are disclosed through error messages or output.
From the perspective of attack tactics, this vulnerability facilitates initial access and execution capabilities consistent with MITRE ATT&CK techniques such as T1505.003 Server Side Request Forgery via Web Templates and potentially T1059 Command and Scripting Interpreter if the executed code runs system commands. The exploitation chain relies on the attacker first obtaining write permissions to the template directory, which may be achieved through other vulnerabilities like broken access control or credential theft, followed by uploading a malicious PHP file and triggering its execution via the public invoice rendering feature.
To mitigate this vulnerability, organizations must upgrade InvoicePlane to version 1.7.2-rc-1 or later, where the issue has been resolved. The fix likely involves implementing strict allow-listing for template files based on specific naming conventions or extensions that exclude executable PHP code from being treated as templates unless explicitly authorized through a more secure mechanism. Additionally, administrators should enforce principle of least privilege by ensuring that web server processes do not have write access to directories containing application logic or configuration files whenever possible. Input validation and sanitization must be applied rigorously to all file upload features, verifying both the content type and the intended use case before storing any user-supplied data in sensitive system directories. Regular security audits of file handling routines are recommended to prevent similar code injection vulnerabilities in open-source applications.