CVE-2026-85290 InvoicePlane CVE debrief

Who should care

Defenders responsible for managing and securing InvoicePlane installations should be aware of this vulnerability and take steps to verify the version in use and assess the potential impact on their systems.

Why it matters

CVE-2026-85290 is a vulnerability in InvoicePlane that allows an unauthenticated requester to place forged log lines into the audit trail. Defenders should prioritize verifying the version of InvoicePlane in use and assessing the potential impact on their systems, particularly if they are using a version prior to 1.7.2.

• Potential corruption of forensic records
• Interference with log-based monitoring
• Possible impact on incident response and threat hunting activities

Technical summary

The Cron::recur() method in InvoicePlane writes an invalid cron key from the URL path directly to the application log without neutralizing CRLF characters. This allows an unauthenticated requester to place forged log lines into the audit trail by supplying a crafted cron_key value, potentially corrupting forensic records and interfering with log-based monitoring. Defenders should prioritize verifying the version of InvoicePlane in use and assessing the potential impact on their systems, particularly if they are using a version prior to 1.7.2.

Defensive priority

Defenders should prioritize verifying the version of InvoicePlane in use and assessing the potential impact on their systems, particularly if they are using a version prior to 1.7.2.

Recommended defensive actions

• Verify the version of InvoicePlane in use and assess the potential impact on systems
• Upgrade to version 1.7.2 or later if using a vulnerable version
• Review logs for potential forged entries and assess the impact on forensic records and log-based monitoring
• Confirm whether affected InvoicePlane deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed InvoicePlane systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed InvoicePlane assets that need extra review
• Track exceptions, retest remediated InvoicePlane assets, and close the item only after evidence is documented

Evidence notes

The evidence for this vulnerability comes from the CVE Program record and the NVD vulnerability detail page. The CVE Program record provides metadata about the vulnerability, while the NVD page provides additional details about the vulnerability and its assessment.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.