CVE-2026-39353 InvoicePlane CVE debrief

Who should care

Defenders responsible for managing InvoicePlane installations should assess exposure and apply the patch. This vulnerability can lead to code execution with web-server privileges, making it a critical concern for InvoicePlane users.

Why it matters

CVE-2026-39353 is a critical vulnerability in InvoicePlane that allows code execution with web-server privileges. Defenders responsible for managing InvoicePlane installations should assess exposure and apply the patch to prevent potential exploitation.

• Code execution with web-server privileges when a public invoice is rendered
• Potential for malicious PHP files to be executed with elevated privileges
• Need for verification of exposure and application of the patch

Technical summary

The vulnerability is caused by InvoicePlane's permitted template list being built by scanning a PHP template directory that can be written through an administrator-controlled file-write capability. A malicious PHP file placed in the directory is automatically trusted by Mdl_templates and can be selected as public_invoice_template. When a public invoice is rendered, the guest View controller includes the trusted file and executes it with web-server privileges.

Defensive priority

Defenders should prioritize verifying exposure and applying the patch, as the vulnerability can lead to code execution with web-server privileges.

Recommended defensive actions

• Verify exposure by checking if the InvoicePlane version is prior to 1.7.2-rc-1
• Apply the patch by upgrading to version 1.7.2-rc-1 or later
• Restrict access to the PHP template directory to prevent malicious file uploads
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is caused by InvoicePlane's permitted template list being built by scanning a PHP template directory that can be written through an administrator-controlled file-write capability. A malicious PHP file placed in the directory is automatically trusted by Mdl_templates and can be selected as public_invoice_template.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.