CVE-2026-39353

CRITICAL 9.1

InvoicePlane: Remote Code Execution via Writable Templates Directory

CVSS Score

9.1

EPSS Score

0.0%

EPSS Percentile

0th

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2-rc-1, InvoicePlane builds its permitted template list by scanning a PHP template directory that can be written through an administrator-controlled file-write capability. A malicious PHP file placed in the directory is automatically trusted by Mdl_templates and can be selected as public_invoice_template. When a public invoice is rendered, the guest View controller includes the trusted file and executes it with web-server privileges. This issue is fixed in version 1.7.2-rc-1.

CWE	CWE-98 CWE-693 CWE-732
Vendor	invoiceplane
Product	invoiceplane
Published	Sep 25, 2026
Last Updated	Sep 25, 2026

Stay Ahead of the Next One

Get instant alerts for invoiceplane invoiceplane

Be the first to know when new critical vulnerabilities affecting invoiceplane invoiceplane are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

InvoicePlane / InvoicePlane

< 1.7.2-rc-1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/InvoicePlane/InvoicePlane/security/advisories/GHSA-v735-2x3r-gwpp github.com: https://github.com/InvoicePlane/InvoicePlane/pull/1536 github.com: https://github.com/InvoicePlane/InvoicePlane/commit/00e599db25804024eb323cfb751349bf3b1d8e8a github.com: https://github.com/InvoicePlane/InvoicePlane/releases/tag/v1.7.2-rc-1