InvoicePlane <= 1.6.3 - Arbitrary File Read

InvoicePlane through 1.6.3 is vulnerable to an unauthenticated path traversal in the guest "Get::getfile" controller. The supplied filename is passed to readfile after a single urldecode with no directory-traversal validation, allowing an unauthenticated attacker to read files outside the...

cve-invoiceplane-advisory

InvoicePlane — Arbitrary File Deletion CVE-2026-39978, CVE-2026-40298 Security advisory and write-up for an arbitrary file deletion / path traversal vulnerability in InvoicePlane. Field| Value ---|--- Product| InvoicePlane Vulnerability| Arbitrary File Deletion via Path Traversal CWE| CWE-22...

CVE-2026-25548

CVE-2026-25548 — Remote Code Execution in InvoicePlane 1.7.0 Vulnerability: Remote Code Execution via Local File Inclusion + Log Poisoning Product: InvoicePlane Affected Version: 1.7.0 and likely prior versions Severity: Critical CVSS 3.1 Score: 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H CW...

CVE-2026-25594

CVE-2026-25594 — Stored XSS via Family Name in InvoicePlane 1.7.0 Vulnerability: Stored Cross-Site Scripting XSS via Family Name field Product: InvoicePlane Affected Version: 1.7.0 and likely prior versions Severity: Medium CVSS 3.1 Score: 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N CWE:...

CVE-2026-25595

CVE-2026-25595 — Stored XSS via Invoice Number in InvoicePlane 1.7.0 Vulnerability: Stored Cross-Site Scripting XSS via Invoice Number field Product: InvoicePlane Affected Version: 1.7.0 and likely prior versions Severity: Medium CVSS 3.1 Score: 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N CW...

CVE-2026-25596

CVE-2026-25596 — Stored XSS via Product Unit Name in InvoicePlane 1.7.0 Vulnerability: Stored Cross-Site Scripting XSS via Product Unit Name field Product: InvoicePlane Affected Version: 1.7.0 and likely prior versions Severity: Medium CVSS 3.1 Score: 4.8...

CVE-2026-23491

CVE-2026-23491: InvoicePlane has Unauthenticated Path Traversal in Guest Controller Overview Field| Details ---|--- CVE ID| CVE-2026-23491 Severity| CRITICAL Advisory| View Advisory Discovered by| Lukasz Rybak Affected Products InvoicePlane/InvoicePlane Details Summary A path traversal...

CVE-2026-55561

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2-beta-1, guest users can approve or reject quotes belonging to any client, not just their assigned clients. The approve and reject methods in the Guest Quotes controller,...

CVE-2026-55561

Prior to version 1.7.2-beta-1 , the InvoicePlane application is vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability in the Guest Quotes controller (application/modules/guest/controllers/Quotes.php). The approve() and reject() methods call approve_quote_by_id($quote_id) and reje...

CVE-2026-55561 InvoicePlane: Guest user IDOR in quote approval and rejection

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2-beta-1, guest users can approve or reject quotes belonging to any client, not just their assigned clients. The approve and reject methods in the Guest Quotes controller,...

CVE-2026-55561 InvoicePlane: Guest user IDOR in quote approval and rejection

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2-beta-1, guest users can approve or reject quotes belonging to any client, not just their assigned clients. The approve and reject methods in the Guest Quotes controller,...

CVE-2026-55561 InvoicePlane: Guest user IDOR in quote approval and rejection

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2-beta-1, guest users can approve or reject quotes belonging to any client, not just their assigned clients. The approve and reject methods in the Guest Quotes controller,...

EUVD-2026-112549

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2-beta-1, guest users can approve or reject quotes belonging to any client, not just their assigned clients. The approve and reject methods in the Guest Quotes controller,...

CVE-2026-55561: InvoicePlane: InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2-beta-1, guest users can approve or reject quotes belonging to any client, not just their assigned clients. The approve and reject methods in the Guest Quotes controller,...

PT-2026-129223

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2-beta-1, guest users can approve or reject quotes belonging to any client, not just their assigned clients. The approve and reject methods in the Guest Quotes controller,...

InvoicePlane authorization issue vulnerability

Versions of InvoicePlane prior to 1.7.2-beta-1 contain an authorization issue vulnerability. This vulnerability arises because the approve and reject methods in application/modules/guest/controllers/Quotes.php fail to perform client-scope validation on quoteid. Additionally, generatepdf calls...

Exploit for CVE-2026-39978

InvoicePlane — Arbitrary File Deletion CVE-2026-39978, CVE-20...

InvoicePlane 1.7.1 Configuration Injection Remote Code Execution

InvoicePlane version 1.7.1 contains a setup-module configuration injection vulnerability that can manipulate environment settings and potentially lead to remote code execution. https://packetstorm.news/download/233763...

CVE-2026-100392

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. In version 1.7.2, Users::form performs no object-level authorization check on userid = 1. A Secondary Administrator usertype = 1, userid != 1 can rewrite the Primary Administrator's usertype to 2...

CVE-2026-100371

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. In version 1.7.2, an authorization guard to Users::changepassword, was added to address a previous authorization flaw that allowed a secondary administrator usertype=1, userid != 1 to directly chan...