CVE-2026-50547— InvoicePlane permits local file inclusion through the e-invoice XML configuration identifier
Quick assessment
Affected
InvoicePlane InvoicePlane
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
InvoicePlane 是一款自托管的开源应用程序，用于管理发票、客户和支付。在版本 1.7.2 之前，InvoicePlane 的 方法会将一个源自数据库的 追加到 XML 配置辅助目录（configs helper directory）中，并包含由此生成的 PHP 路径，但未对该标识符进行验证。具备较低权限的攻击者若能够影响电子发票配置，便可以利用路径遍历序列来包含（include）一个已存在的 PHP 文件。该独立安全公告将其定性为本地文件包含（Local File Inclusion）漏洞；要实现代码执行
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-50547
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
InvoicePlane permits local file inclusion through the e-invoice XML configuration identifier
Source: CVE Program / CVE List V5
Vulnerability Description
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane's Invoices::generate_xml() method appends a database-derived xml_id to the XMLconfigs helper directory and includes the resulting PHP path without validating the identifier. A low-privileged attacker who can influence the e-invoice configuration can use traversal sequences to include an existing PHP file. The standalone advisory establishes local file inclusion; code execution requires a separate file-upload or file-write primitive. This issue is fixed in version 1.7.2.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| InvoicePlane | InvoicePlane | < 1.7.2 | - |
|
II. Public POCs for CVE-2026-50547
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-50547
请登录查看更多情报信息。
Other References for CVE-2026-50547 (4)
-
https://github.com/InvoicePlane/InvoicePlane/pull/1560 x_refsource_MISC
-
https://github.com/InvoicePlane/InvoicePlane/releases/tag/v1.7.2 x_refsource_MISC
Same Patch Batch · InvoicePlane · 2026-09-25 · 13 CVEs total
| CVE-2026-39353 | 9.1 CRITICAL | InvoicePlane: Remote Code Execution via Writable Templates Directory |
| CVE-2026-88003 | 7.5 HIGH | InvoicePlane: Failure to Revoke Administrative Privileges After Role Downgrade |
| CVE-2026-49850 | 7.5 HIGH | InvoicePlane: Missing CSRF Protection on State-Changing delete Actions |
| CVE-2026-33639 | 7.2 HIGH | InvoicePlane permits DDL injection through tax_rate_decimal_places |
| CVE-2026-85291 | 6.5 MEDIUM | InvoicePlane IDOR: Horizontal Privilege Escalation via Password Change Without Authorizati |
| CVE-2026-85274 | 6.5 MEDIUM | InvoicePlane: Recurring Invoice State Change via GET Request Without CSRF Protection |
| CVE-2026-85289 | 6.5 MEDIUM | InvoicePlane: Missing CSRF Token Validation on Multiple Delete Endpoints |
| CVE-2026-54790 | 6.0 MEDIUM | InvoicePlane: Second-order SQL injection through the unvalidated custom_field_table field |
| CVE-2026-85290 | 5.3 MEDIUM | InvoicePlane: Log Injection via Unsanitized User Input in Cron Key Error Logging |
| CVE-2026-39372 | 4.9 MEDIUM | InvoicePlane: Sensitive Information Disclosure via Unstripped EXIF Metadata in Attachments |
| CVE-2026-85292 | 4.8 MEDIUM | InvoicePlane: Loose Type Comparison in Core Authentication Check (Defense-in-Depth) |
| CVE-2026-85293 | 4.8 MEDIUM | InvoicePlane: Stored Cross-Site Scripting (XSS) via Client Email in Invoice and Quote Mail |
IV. Related Vulnerabilities
Same product: InvoicePlane
-
CVE-2026-88003
InvoicePlane: Failure to Revoke Administrative Privileges A -
CVE-2026-49850
InvoicePlane: Missing CSRF Protection on State-Changing dele -
CVE-2026-33639
InvoicePlane permits DDL injection through tax_rate_decimal_ -
CVE-2026-39353
InvoicePlane: Remote Code Execution via Writable Templates D -
CVE-2026-85293
InvoicePlane: Stored Cross-Site Scripting (XSS) via Client E
Same vendor: InvoicePlane
-
CVE-2026-88003
InvoicePlane: Failure to Revoke Administrative Privileges A -
CVE-2026-49850
InvoicePlane: Missing CSRF Protection on State-Changing dele -
CVE-2026-33639
InvoicePlane permits DDL injection through tax_rate_decimal_ -
CVE-2026-39353
InvoicePlane: Remote Code Execution via Writable Templates D -
CVE-2026-85293
InvoicePlane: Stored Cross-Site Scripting (XSS) via Client E
Same weakness: CWE-22
-
CVE-2026-90925
Path Traversal in Innotim Software's Logsign SIEM -
CVE-2026-85185
Path traversal in LXD btrfs storage driver allows arbitrary -
CVE-2026-85526
Path traversal via Btrfs optimized-backup subvolumes[].path -
CVE-2026-86334
CLI Path Traversal via Content-Disposition in LXD Image Expo -
CVE-2026-15953
Path Traversal During Project Archive Import
V. Comments for CVE-2026-50547
No comments yet