CVE-2026-39372
InvoicePlane: Sensitive Information Disclosure via Unstripped EXIF Metadata in Attachments
CVSS Score
4.9
EPSS Score
0.0%
EPSS Percentile
0th
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane stores and serves uploaded image attachments without stripping EXIF metadata. When an administrator uploads an image through invoice attachments, quote attachments, or another attachment feature and shares it with another user, the recipient can retrieve embedded GPS coordinates, timestamps, and device information. The preserved metadata can disclose private location and device details across users. This vulnerability is fixed in 1.7.2.
| CWE | CWE-359 CWE-200 |
| Vendor | invoiceplane |
| Product | invoiceplane |
| Published | Sep 25, 2026 |
Stay Ahead of the Next One
Get instant alerts for invoiceplane invoiceplane
Be the first to know when new medium vulnerabilities affecting invoiceplane invoiceplane are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Affected Versions
InvoicePlane / InvoicePlane
< 1.7.2
References
github.com: https://github.com/InvoicePlane/InvoicePlane/security/advisories/GHSA-7j67-2v6p-275v github.com: https://github.com/InvoicePlane/InvoicePlane/pull/1507 github.com: https://github.com/InvoicePlane/InvoicePlane/commit/90381b49d9ff3a817cf25d12d7dc118eb070aa3a github.com: https://github.com/InvoicePlane/InvoicePlane/releases/tag/v1.7.2