7.5
CVE-2026-50547
- EPSS 0.47%
- Veröffentlicht 25.09.2026 15:38:31
- Zuletzt bearbeitet 28.09.2026 15:07:51
- Erkennungen
InvoicePlane permits local file inclusion through the e-invoice XML configuration identifier
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane's Invoices::generate_xml() method appends a database-derived xml_id to the XMLconfigs helper directory and includes the resulting PHP path without validating the identifier. A low-privileged attacker who can influence the e-invoice configuration can use traversal sequences to include an existing PHP file. The standalone advisory establishes local file inclusion; code execution requires a separate file-upload or file-write primitive. This issue is fixed in version 1.7.2.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerInvoicePlane
≫
Produkt
InvoicePlane
Version
< 1.7.2
Status
affected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. 
Login
Login| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.47% | 0.377 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| security-advisories@github.com | 7.5 | 1.6 | 5.9 |
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
|
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.
https://github.com/InvoicePlane/InvoicePlane/releases/tag/v1.7.2
https://github.com/InvoicePlane/InvoicePlane/security/advisories/GHSA-9248-qccw-7x7j
https://github.com/InvoicePlane/InvoicePlane/pull/1560
https://github.com/InvoicePlane/InvoicePlane/commit/07ebd6b5922b47b941cc3c6922c39043ad558d8f