SQL Injection in InvoicePlane Affects Database Integrity

CVE-2026-33639

What is CVE-2026-33639?

InvoicePlane, an open-source application for managing invoices and payments, suffers from a vulnerability in its tax_rate_decimal_places setting. Prior to version 1.7.2, this vulnerable functionality fails to properly validate input, leading to potential SQL injection via malformed values. A malicious actor could manipulate this setting in such a way that it modifies the underlying ALTER TABLE statement, resulting in unexpected changes to the database schema. This could lead to the deletion or alteration of critical columns, ultimately corrupting financial data and rendering the application inoperable. Users are advised to upgrade to version 1.7.2 or later to mitigate this risk.

References