CVE-2026-39353— InvoicePlane: Remote Code Execution via Writable Templates Directory
Quick assessment
Affected
InvoicePlane InvoicePlane
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
InvoicePlane 是一款自托管的开源应用，用于管理发票、客户和支付。在版本 1.7.2-rc-1 之前，InvoicePlane 通过扫描一个可通过管理员控制的文件写入权限进行写入的 PHP 模板目录，来构建其允许的模板列表。攻击者若将该目录中放置恶意 PHP 文件，该文件会被 Mdl_templates 自动信任，并可选作 public_invoice_template（公开发票模板）。当公开发票被渲染时，guest View 控制器会包含并执行该受信任的文件，且以 Web 服务器权限运行。该问题已在 1
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-39353
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
InvoicePlane: Remote Code Execution via Writable Templates Directory
Source: CVE Program / CVE List V5
Vulnerability Description
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2-rc-1, InvoicePlane builds its permitted template list by scanning a PHP template directory that can be written through an administrator-controlled file-write capability. A malicious PHP file placed in the directory is automatically trusted by Mdl_templates and can be selected as public_invoice_template. When a public invoice is rendered, the guest View controller includes the trusted file and executes it with web-server privileges. This issue is fixed in version 1.7.2-rc-1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
PHP程序中Include/Require语句包含文件控制不恰当(PHP远程文件包含)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| InvoicePlane | InvoicePlane | < 1.7.2-rc-1 | - |
|
II. Public POCs for CVE-2026-39353
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-39353
请登录查看更多情报信息。
Other References for CVE-2026-39353 (4)
-
https://github.com/InvoicePlane/InvoicePlane/pull/1536 x_refsource_MISC
Same Patch Batch · InvoicePlane · 2026-09-25 · 13 CVEs total
| CVE-2026-88003 | 7.5 HIGH | InvoicePlane: Failure to Revoke Administrative Privileges After Role Downgrade |
| CVE-2026-49850 | 7.5 HIGH | InvoicePlane: Missing CSRF Protection on State-Changing delete Actions |
| CVE-2026-50547 | 7.5 HIGH | InvoicePlane permits local file inclusion through the e-invoice XML configuration identifi |
| CVE-2026-33639 | 7.2 HIGH | InvoicePlane permits DDL injection through tax_rate_decimal_places |
| CVE-2026-85291 | 6.5 MEDIUM | InvoicePlane IDOR: Horizontal Privilege Escalation via Password Change Without Authorizati |
| CVE-2026-85274 | 6.5 MEDIUM | InvoicePlane: Recurring Invoice State Change via GET Request Without CSRF Protection |
| CVE-2026-85289 | 6.5 MEDIUM | InvoicePlane: Missing CSRF Token Validation on Multiple Delete Endpoints |
| CVE-2026-54790 | 6.0 MEDIUM | InvoicePlane: Second-order SQL injection through the unvalidated custom_field_table field |
| CVE-2026-85290 | 5.3 MEDIUM | InvoicePlane: Log Injection via Unsanitized User Input in Cron Key Error Logging |
| CVE-2026-39372 | 4.9 MEDIUM | InvoicePlane: Sensitive Information Disclosure via Unstripped EXIF Metadata in Attachments |
| CVE-2026-85292 | 4.8 MEDIUM | InvoicePlane: Loose Type Comparison in Core Authentication Check (Defense-in-Depth) |
| CVE-2026-85293 | 4.8 MEDIUM | InvoicePlane: Stored Cross-Site Scripting (XSS) via Client Email in Invoice and Quote Mail |
IV. Related Vulnerabilities
Same product: InvoicePlane
-
CVE-2026-88003
InvoicePlane: Failure to Revoke Administrative Privileges A -
CVE-2026-49850
InvoicePlane: Missing CSRF Protection on State-Changing dele -
CVE-2026-50547
InvoicePlane permits local file inclusion through the e-invo -
CVE-2026-33639
InvoicePlane permits DDL injection through tax_rate_decimal_ -
CVE-2026-85293
InvoicePlane: Stored Cross-Site Scripting (XSS) via Client E
Same vendor: InvoicePlane
-
CVE-2026-88003
InvoicePlane: Failure to Revoke Administrative Privileges A -
CVE-2026-49850
InvoicePlane: Missing CSRF Protection on State-Changing dele -
CVE-2026-50547
InvoicePlane permits local file inclusion through the e-invo -
CVE-2026-33639
InvoicePlane permits DDL injection through tax_rate_decimal_ -
CVE-2026-85293
InvoicePlane: Stored Cross-Site Scripting (XSS) via Client E
Same weakness: CWE-98
-
CVE-2026-13456
WP Maps <= 4.9.8 - Authenticated (Subscriber+) Local File In -
CVE-2026-12227
Visual Composer Website Builder <= 45.16.0 - Unauthenticated -
CVE-2026-87902
WordPress 6.7.1 get_page_template 本地文件包含 -
CVE-2026-9231
WP Travel Engine <= 6.8.0 - Authenticated (Contributor+) Loc -
CVE-2026-92969
HUSKY <= 1.4.4 - Unauthenticated Local File Inclusion via 'c
V. Comments for CVE-2026-39353
No comments yet