CVE-2026-50547 in InvoicePlane
Summary
by MITRE • 09/25/2026
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane's Invoices::generate_xml() method appends a database-derived xml_id to the XMLconfigs helper directory and includes the resulting PHP path without validating the identifier. A low-privileged attacker who can influence the e-invoice configuration can use traversal sequences to include an existing PHP file. The standalone advisory establishes local file inclusion; code execution requires a separate file-upload or file-write primitive. This issue is fixed in version 1.7.2.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/25/2026
InvoicePlane serves as a self-hosted open-source solution for managing invoices, clients, and payments, presenting itself as an alternative to commercial accounting software. The vulnerability identified within versions prior to 1.7.2 resides specifically within the Invoices::generate_xml() method. This function is responsible for generating XML configurations related to e-invoicing features. During its execution, the application constructs a file path by appending a database-derived identifier, referred to as xml_id, directly into the XMLconfigs helper directory. Crucially, this process fails to perform any validation or sanitization on the input value retrieved from the database before incorporating it into the filesystem operation. This lack of rigorous input verification creates a critical security gap that allows for malicious manipulation of file paths by an attacker who has access to influence e-invoice configuration settings.
The technical flaw is classified as a Local File Inclusion vulnerability, which aligns with CWE-98 in the Common Weakness Enumeration taxonomy. By exploiting this weakness, a low-privileged attacker can inject directory traversal sequences into the xml_id parameter. When the application processes these malicious inputs, it resolves to file paths outside of the intended scope or targets existing PHP files within the web root. The immediate operational impact is the ability for an unauthorized user to force the server to include and execute arbitrary code contained in pre-existing files on the system. This mechanism effectively bypasses standard access controls because the inclusion occurs through a legitimate application function that has higher privileges than the attacker's direct account level, although it does not inherently grant full remote code execution without additional prerequisites.
It is important to distinguish this vulnerability from Remote Code Execution or Local File Read in isolation. The standalone advisory clarifies that while local file inclusion is achieved, actual arbitrary code execution requires a separate primitive such as file upload or file write capabilities. This means the attacker must already have some level of control over specific files on the server to leverage this flaw for full compromise. However, even without immediate remote code execution, the ability to include sensitive PHP configuration files can lead to information disclosure, potentially exposing database credentials, API keys, and other internal application logic that aids in further exploitation phases. This behavior is consistent with techniques observed in ATT&CK framework mappings related to Server Side Request Forgery or Local File Inclusion depending on the specific context of file access versus execution.
The resolution for this issue was implemented in version 1.7.2, where developers introduced proper validation mechanisms for the xml_id parameter. Mitigation strategies involve upgrading to the patched version immediately if running an older release. For environments that cannot be updated instantly, administrators should ensure that web server configurations restrict access to sensitive directories and implement strict input validation at the application layer for all parameters interacting with file system operations. Additionally, applying the principle of least privilege ensures that even if such a flaw exists in other components, the impact is contained by limiting what files can be included or executed based on user roles. Regular security audits and code reviews focusing on dynamic include statements are recommended to prevent similar vulnerabilities from being introduced during future development cycles.