Vulnerability in InvoicePlane Allows Unauthorized Execution of Malicious PHP Files

CVE-2026-39353

What is CVE-2026-39353?

InvoicePlane, an open-source self-hosted application for managing invoices and payments, has a vulnerability wherein it builds its permitted template list by scanning a writable PHP template directory controlled by administrators. This flaw allows a malicious user to place a PHP file within that directory, which is then automatically recognized by Mdl_templates as a valid template. Consequently, when a public invoice is generated, the web application includes and executes the malicious file with web-server privileges, potentially compromising the server. This vulnerability has been addressed in version 1.7.2-rc-1.

References