Image Metadata Exposure in InvoicePlane by InvoicePlane
CVE-2026-39372

4.9MEDIUM

Key Information:

Vendor

Invoiceplane

Status
Invoiceplane
Vendor
CVE Published:
25 September 2026

What is CVE-2026-39372?

Prior to version 1.7.2, InvoicePlane allows uploaded image attachments to retain EXIF metadata, which includes sensitive information such as GPS coordinates, timestamps, and device details. This can lead to unintended data exposure, as users can inadvertently share private location information with others. The vulnerability has been addressed in version 1.7.2, emphasizing the importance of keeping software updated.

Affected Version(s)

InvoicePlane < 1.7.2

References

https://github.com/InvoicePlane/InvoicePlane/security/adv...
x_refsource_CONFIRM
https://github.com/InvoicePlane/InvoicePlane/pull/1507
x_refsource_MISC
https://github.com/InvoicePlane/InvoicePlane/commit/90381...
x_refsource_MISC

CVSS V3.1

Score:
4.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.