CVE-2026-39372 in InvoicePlane
Summary
by MITRE • 09/25/2026
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane stores and serves uploaded image attachments without stripping EXIF metadata. When an administrator uploads an image through invoice attachments, quote attachments, or another attachment feature and shares it with another user, the recipient can retrieve embedded GPS coordinates, timestamps, and device information. The preserved metadata can disclose private location and device details across users. This vulnerability is fixed in 1.7.2.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/25/2026
InvoicePlane serves as a self-hosted open source application designed for managing invoices, clients, and payments within organizational workflows. Prior to version 1.7.2, the software exhibited a significant information disclosure vulnerability related to how it handles uploaded image attachments. The core technical flaw lies in the absence of metadata sanitization during file processing. When an administrator uploads images through various attachment features such as invoice or quote attachments, and subsequently shares these files with other users within the system, InvoicePlane stores and serves these images without stripping embedded EXIF (Exchangeable Image File Format) data. This oversight means that any auxiliary information embedded in the image file by the capturing device is preserved intact and remains accessible to anyone who views or downloads the attachment.
The operational impact of this vulnerability extends beyond simple metadata retention, posing a tangible risk to user privacy and organizational security. The preserved EXIF data can include precise GPS coordinates indicating where the photo was taken, timestamps revealing when it was captured, and detailed device information such as make, model, and software version. For an administrator or any authorized user sharing sensitive documents like invoices or quotes, this metadata leakage can inadvertently disclose private location details and internal infrastructure specifics to external parties if those files are shared outside the secure environment, or even internally among users who do not require that level of contextual data. This exposure violates principles of least privilege and minimal data retention, potentially aiding adversaries in physical reconnaissance or social engineering attacks by providing accurate geolocation and device fingerprinting data.
From a classification perspective, this vulnerability aligns with CWE-200: Information Exposure, specifically falling under the sub-category of sensitive information leakage through file metadata. It also relates to CWE-614: Sensitive Cookie in HTTPS Session Without Strictly Enforced Secure Flag if one considers the broader context of session integrity, though primarily it is a data handling flaw. In terms of adversary tactics, this behavior supports reconnaissance activities as defined by MITRE ATT&CK technique T1083: File and Directory Discovery, where an attacker or malicious insider gathers information about files and their properties to understand the environment better. The lack of sanitization allows for passive collection of intelligence that could be used to map physical locations associated with business operations or identify specific hardware vulnerabilities based on device models listed in the metadata.
To mitigate this risk, organizations using InvoicePlane must ensure they are running version 1.7.2 or later, where the developers have implemented proper sanitization routines to strip EXIF data upon upload. For environments still operating on older versions, immediate remediation is critical until an upgrade can be performed. Administrators should manually review and sanitize any previously uploaded images that contain sensitive metadata before sharing them with external parties. Furthermore, implementing a policy of regular security audits for file handling processes across all web applications can prevent similar oversights in other systems. It is also advisable to configure server-side image processing pipelines to automatically strip non-essential metadata as a standard practice, ensuring that only the visual content required for business operations is retained and served, thereby reducing the attack surface associated with information leakage vulnerabilities.