SQL Injection Vulnerability in InvoicePlane by InvoicePlane

CVE-2026-54790

What is CVE-2026-54790?

InvoicePlane, which is a self-hosted open-source application for managing invoices, clients, and payments, had a vulnerability that allowed an administrator-controlled custom_field_table value to be stored without adequate validation against permitted custom-field names. This design flaw meant that when the custom-field edit form was executed, it was vulnerable to a second-order SQL injection attack. This issue permitted attackers to craft queries that could access arbitrary schema data and triggered application errors or potential denial of service scenarios. The vulnerability has been addressed in version 1.7.2.

References