CVE-2026-39372

Deferred Deferred - Pending Action

EXIF Metadata Exposure in InvoicePlane

Publication date: 2026-09-25

Last updated on: 2026-09-29

Assigner: GitHub, Inc.

Description

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane stores and serves uploaded image attachments without stripping EXIF metadata. When an administrator uploads an image through invoice attachments, quote attachments, or another attachment feature and shares it with another user, the recipient can retrieve embedded GPS coordinates, timestamps, and device information. The preserved metadata can disclose private location and device details across users. This vulnerability is fixed in 1.7.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-09-29

Generated

2026-10-16

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-39372

EUVD

EUVD-2026-87122

Affected Vendors & Products

Vendor	Product	Version / Range
invoiceplane	invoiceplane	to 1.7.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-359	The product does not properly prevent a person's private, personal information from being accessed by actors who either (1) are not explicitly authorized to access the information or (2) do not have the implicit consent of the person about whom the information is collected.
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

InvoicePlane before version 1.7.2 stores and serves uploaded image attachments without removing EXIF metadata. This allows GPS coordinates, timestamps, and device details embedded in images to be exposed when shared between users. Attackers could extract private location and device information from these images.

Detection Guidance

To detect this vulnerability, inspect uploaded image files for EXIF metadata using tools like exiftool or identify files with GPS coordinates. Check InvoicePlane attachment directories for images and analyze their metadata for location or device details.

Impact Analysis

If you use InvoicePlane versions before 1.7.2, uploading images with EXIF data could expose your location, device details, or timestamps to other users. This may lead to privacy breaches or tracking of your activities through shared images.

Compliance Impact

This vulnerability could violate GDPR by exposing personal data like location without consent. For HIPAA, it may risk protected health information if images contain metadata linking to patient data. Organizations must ensure metadata is stripped to comply with privacy regulations.

Mitigation Strategies

Upgrade InvoicePlane to version 1.7.2 or later to patch the vulnerability. Remove or sanitize existing image attachments to strip EXIF metadata. Review user-uploaded files for sensitive information before sharing.

Hi! I’m here to help you understand CVE-2026-39372. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70