Executive Summary
A critical remote code execution vulnerability, tracked as CVE-2026-39353, has been disclosed in InvoicePlane, a self-hosted open source application widely used to manage invoices, clients, and payments. The flaw carries a CVSS score of 9.1 (Critical) and stems from how InvoicePlane builds its list of "permitted" invoice templates: it simply scans a PHP template directory at runtime and trusts whatever it finds there.
Because that directory can be written to through an administrator-controlled file-write capability, an attacker who obtains admin access (or abuses a feature that writes into the templates path) can drop a malicious PHP file into it. InvoicePlane's Mdl_templates model automatically treats that file as a legitimate, selectable template. Once it is set as the public_invoice_template, the unauthenticated guest View controller includes and executes it on every public invoice request — turning a single write primitive into full web-server-privileged remote code execution reachable without any authentication. The issue is fixed in InvoicePlane 1.7.2-rc-1, released 2026-09-25.
Vulnerability Overview
| Attribute | Value |
|---|---|
| CVE ID | CVE-2026-39353 |
| CVSS Score | 9.1 (Critical) — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H |
| Type | Improper Control of Filename for Include/Require (CWE-98, PHP Remote File Inclusion) |
| Attack Vector | Network |
| Privileges Required | High (initial file write requires administrator-level access); resulting code execution is unauthenticated |
| User Interaction | None |
Affected Versions
| Product | Affected Versions | Fixed Version |
|---|---|---|
| InvoicePlane | <= 1.7.2-rc-1 | 1.7.2-rc-1 |
Attack Vector
1. Attacker obtains administrator-level access to InvoicePlane
(compromised admin credentials, or abuse of an admin-facing
file-write feature that touches the template directory)
2. Attacker writes a malicious PHP file into the invoice template
directory (application/views/invoice_templates/public/), e.g.:
<?php echo shell_exec($_GET['cmd']); ?>
3. Mdl_templates::validate_template_name() rebuilds its "permitted
templates" whitelist by scanning the directory at request time —
any .php file present is automatically trusted as a valid template,
with no signature, ownership, or content check
4. Attacker sets the public_invoice_template application setting
(via the admin panel) to point at the newly planted file
5. Any unauthenticated visitor requesting a public invoice URL
triggers the guest View controller, which includes and executes
the selected "template" file server-side
6. Malicious PHP runs with web server privileges — no authentication
required for this final, damaging step — yielding full command
execution, database access, and file system controlThe vulnerability is effectively a chain of three weaknesses: a template directory that is writable through an administrative feature, a whitelist that is built by directory scan rather than an explicit allow-list, and an unauthenticated public endpoint that blindly includes whatever template is currently configured. Individually each step looks low-risk; combined, they turn an admin-scoped write into unauthenticated RCE — which is why the CVSS vector marks privileges required as High for the entry point but Scope: Changed for the impact.
Impact of Successful Exploitation
| Impact Area | Description |
|---|---|
| Remote Code Execution | Arbitrary PHP execution with web server privileges, reachable without authentication once the template is planted |
| Data Exposure | Full read access to the InvoicePlane database, including client PII, invoices, and payment records |
| Credential Theft | Database credentials and application secrets in configuration files become accessible |
| Persistence | Webshells planted as "templates" can survive application updates that do not clear the template directory |
| Lateral Movement | Compromised host can pivot to other services sharing the same server or network segment |
| Service Integrity | Attacker can modify invoices, client records, and payment data, undermining financial integrity |
Immediate Remediation
Step 1: Upgrade to InvoicePlane 1.7.2-rc-1
# Back up the database and application directory first
cp -r /path/to/invoiceplane /path/to/invoiceplane.bak
# Pull the patched release and redeploy per your normal update process
# (see InvoicePlane's official upgrade documentation for your install method)Confirm the version banner in the admin panel reflects 1.7.2-rc-1 or newer after the upgrade.
Step 2: Audit the Template Directory Now
# List everything currently sitting in the public template directory
ls -la application/views/invoice_templates/public/
# Flag any .php file that isn't part of the shipped InvoicePlane distribution
find application/views/invoice_templates/ -name "*.php" -newer application/config/config.phpRemove any unrecognized .php files and check the public_invoice_template setting in the database for an unexpected value.
Step 3: Harden Access in the Meantime
- Restrict admin panel access to trusted IP ranges or a VPN — this vulnerability's entry point requires admin-level access, so limiting who can reach the admin UI meaningfully reduces exposure.
- Review all administrator accounts for ones you don't recognize, and rotate admin passwords.
- Disable or lock down any file-write feature exposed to admins that can place files inside the template directory tree, until patched.
- Deploy file integrity monitoring on
application/views/invoice_templates/to alert on new or modified files. - Run the web server process with least privilege so a successful exploit has minimal reach into the underlying OS.
If You Cannot Patch Immediately
Consider taking the public invoice view offline (or placing it behind authentication at the reverse proxy) until the upgrade is complete, since that endpoint is the final trigger for code execution.
Detection Indicators
| Indicator | Description |
|---|---|
New or modified .php files under application/views/invoice_templates/ | Possible malicious template plant |
Changes to the public_invoice_template setting outside of normal admin activity | Attacker pointing the guest view at a planted file |
| Unexpected admin logins or password resets | Possible credential compromise preceding exploitation |
Anomalous requests to guest/view/invoice/* endpoints | Possible trigger of the malicious template |
| Outbound connections or child processes spawned by the PHP-FPM/web server user | Post-exploitation activity from a successful webshell |