InvoicePlane v1.7.2 Security Update: Fixes Critical RCE, SQLi, Auth Bypass

InvoicePlane v1.7.2 Security Update Summary Vulnerability Overview InvoicePlane v1.7.2 is a security-focused release that resolves all disclosed vulnerabilities affecting v1.7.0 and v1.7.1, as well as additional issues discovered during subsequent reviews. Key Fixes: Critical: CVSS 9.9 Remote Code Execution (RCE) vulnerability High: Multiple SQL injections, arbitrary file deletion, authentication bypasses, IDOR, CSRF, etc. Medium: Abuse of password reset emails, authentication bypasses, stored XSS, exposure of sensitive fields, etc. Low: Duplicate payment processing, non-constant time comparisons, debug information leakage, etc. Scope of Impact Affected Versions: v1.7.0, v1.7.1 Fixed Version: v1.7.2 Recommendation: Upgrade to v1.7.2 immediately Remediation Measures Critical High Medium Low Other Improvements Custom Templates and Configuration PR-1648: Added custom template allow list constants to PR-1662: Corrected upgrade documentation: points only to directories without templates PR-1663: Clarified custom template documentation: Administrators must provide template files and matching allow list entries PR-1656: Administrators upgrading to legacy custom templates now receive target completion and setup page warnings Payment Processing PR-1627: Stripe zero-decimal currencies: Checkout Sessions now use the configured currency's decimal places PR-1289: Re-introduced Stripe + PayPal, adding support for PayPal Advanced Credit Card and Venmo Infrastructure PR-1509: Added Docker application container (combining Web server + PHP) PR-1489: QR code size on invoices is now configurable Bug Fixes PR-1665: no longer reports "delete failed" errors for already deleted files PR-1680: Cryptographic Binary-Safe Regression: silently falls back to on binary ciphertext (triggered by truncated Pin rules), causing SMTP authentication failures. Reverted to byte-safe / , disabling SMTP authentication for affected users PR-1681: Session configuration and were incorrectly read from , making it impossible to rename session cookies or tables without changing the driver name Full Changelog View Full Changelog

Goal Reached Thanks to every supporter — we hit 100%!

InvoicePlane v1.7.2 Security Update: Fixes Critical RCE, SQLi, Auth Bypass

More from this source