CVE-2026-39353

Deferred Deferred - Pending Action

Stored PHP Code Execution in InvoicePlane

Publication date: 2026-09-25

Last updated on: 2026-09-28

Assigner: GitHub, Inc.

Description

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2-rc-1, InvoicePlane builds its permitted template list by scanning a PHP template directory that can be written through an administrator-controlled file-write capability. A malicious PHP file placed in the directory is automatically trusted by Mdl_templates and can be selected as public_invoice_template. When a public invoice is rendered, the guest View controller includes the trusted file and executes it with web-server privileges. This issue is fixed in version 1.7.2-rc-1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-09-28

Generated

2026-10-16

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-39353

EUVD

EUVD-2026-87129

Affected Vendors & Products

Vendor	Product	Version / Range
invoiceplane	invoiceplane	to 1.7.2-rc-1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-732	The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
CWE-98	The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.
CWE-693	The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

Attack-Flow Graph

Executive Summary

InvoicePlane before version 1.7.2-rc-1 allows an administrator to upload malicious PHP files into a template directory. These files are automatically trusted and can be selected as invoice templates. When a public invoice is rendered, the system executes the malicious PHP file with web-server privileges, leading to remote code execution.

Detection Guidance

Check for unauthorized PHP files in InvoicePlane's template directories, particularly those writable by administrators. Review files in the PHP template directory for unexpected or recently modified files. Use commands like 'find /path/to/template/dir -name "*.php" -type f' to list PHP files and 'ls -la' to check permissions.

Impact Analysis

An attacker with administrator access could exploit this to execute arbitrary code on the server, potentially stealing sensitive data, installing malware, or taking control of the system. Even without direct admin access, if an attacker can upload files to the template directory, they could trigger this vulnerability.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's security rules. Organizations using affected versions may face compliance violations, legal penalties, and reputational damage due to potential data breaches.

Mitigation Strategies

Upgrade InvoicePlane to version 1.7.2-rc-1 or later immediately. Remove write permissions from the template directory for non-admin users. Audit all PHP files in the template directory for unauthorized changes. Restrict access to the template directory to trusted administrators only.

Hi! I’m here to help you understand CVE-2026-39353. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70