Description

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2-rc-1, InvoicePlane builds its permitted template list by scanning a PHP template directory that can be written through an administrator-controlled file-write capability. A malicious PHP file placed in the directory is automatically trusted by Mdl_templates and can be selected as public_invoice_template. When a public invoice is rendered, the guest View controller includes the trusted file and executes it with web-server privileges. This issue is fixed in version 1.7.2-rc-1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-09-25T16:17:25.053Z",
  "pubdate": "2026-09-25T16:17:25.053Z",
  "executiveSummary": "InvoicePlane versions prior to 1.7.2-rc-1 are vulnerable to Arbitrary Code Execution resulting from an insecure template management implementation.\nThe vulnerability originates from a design flaw where the application automatically trusts files within the templates directory, which can be modified via an administrator-controlled file-write capability.\nAn attacker with administrative access can upload malicious PHP code into the template directory, which is subsequently interpreted and executed by the server when the public invoice rendering function is invoked.\nThis vulnerability leads to full application compromise and potential remote code execution on the underlying host with web-server privileges.\nThe risk is critical as it allows an authenticated administrator to escalate their control to the operating system level, bypass security controls, and perform unauthorized actions on the server.\nExploitation requires administrative access to the platform to manipulate the file system, after which the payload is triggered through the guest-accessible View controller.",
  "technicalDetails": "The vulnerability resides in the Mdl_templates module, which is responsible for managing and validating templates used for invoice generation.\nThe root cause of this security flaw is the implicit trust mechanism utilized by the application when scanning the template directory for valid files.\nThe application dynamically populates the list of permitted templates by iterating over the contents of a specific directory. Because there is no integrity verification or sanitization mechanism applied to the files within this directory, any file residing there is treated as a valid template.\nAn authenticated user with administrative privileges can leverage the application's built-in file-write capabilities to upload a crafted PHP file directly into the template directory.\nOnce the file is placed, it is indexed by Mdl_templates. An attacker can then configure the application to utilize this malicious file as the 'public_invoice_template'.\nThe attack flow continues when the View controller, which handles public invoice rendering, is invoked. The controller includes the attacker-controlled file and executes it within the context of the web-server process.\nBecause the execution occurs with web-server privileges, the payload can perform arbitrary system commands, interact with the application database, or pivot to other internal network services.\nThe exploitation path is: 1) Admin-level authenticated file upload to the template directory; 2) Configuration update to point 'public_invoice_template' to the malicious script; 3) Triggering the View controller for public invoice generation; 4) Execution of the injected PHP payload by the application runtime.\nThis vulnerability is effectively an arbitrary file inclusion/execution flaw facilitated by insecure directory trust logic, affecting all versions of InvoicePlane prior to 1.7.2-rc-1."
}