CVE-2026-85290

Deferred Deferred - Pending Action

Stored CRLF Injection in InvoicePlane Audit Log

Publication date: 2026-09-25

Last updated on: 2026-09-29

Assigner: GitHub, Inc.

Description

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane's Cron::recur() method writes an invalid cron key from the URL path directly to the application log without neutralizing CRLF characters. An unauthenticated requester can place forged log lines into the audit trail by supplying a crafted cron_key value. The injected entries can corrupt forensic records and interfere with log-based monitoring. This issue is fixed in version 1.7.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-09-29

Generated

2026-10-16

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-85290

EUVD

EUVD-2026-87123

Affected Vendors & Products

Vendor	Product	Version / Range
invoiceplane	invoiceplane	to 1.7.2 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-117	The product constructs a log message from external input, but it does not neutralize or incorrectly neutralizes special elements when the message is written to a log file.

Attack-Flow Graph

Executive Summary

InvoicePlane before version 1.7.2 has a flaw in its Cron::recur() method where it logs an invalid cron key from the URL without sanitizing CRLF characters. This allows unauthenticated attackers to inject forged log entries by crafting a malicious cron_key value. These fake entries can corrupt audit trails and disrupt log-based monitoring systems.

Detection Guidance

Check InvoicePlane application logs for entries containing 'cron_key' with CRLF characters or unusual formatting. Look for log corruption or forged entries in the audit trail.

Impact Analysis

This vulnerability allows attackers to manipulate log files by inserting fake entries. This can corrupt forensic records, making it harder to investigate security incidents. It may also interfere with automated log monitoring tools that rely on accurate audit trails.

Compliance Impact

This vulnerability could potentially affect compliance with GDPR and HIPAA by allowing unauthorized log injection. Forged log entries could corrupt forensic records, making it difficult to maintain accurate audit trails required for regulatory compliance. Log-based monitoring systems might also be misled by tampered entries.

Mitigation Strategies

Upgrade InvoicePlane to version 1.7.2 or later to address the CRLF injection issue in the Cron::recur() method.

Hi! I’m here to help you understand CVE-2026-85290. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70