InvoicePlane vulnerabilities
We track 16 vulnerabilities in InvoicePlane products. 16 are rated high or critical, and none are known to be exploited. The most recent was published on September 28, 2026.
Latest InvoicePlane vulnerabilities
- 7.0 High severity
InvoicePlane: Incorrect Authorization
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. In version 1.7.2, Users::form() performs no object-level authorization check on user_id = 1. A Secondary Administrator (user_type = 1, user_id != 1) can rewrite
- 8.7 High severity
InvoicePlane: Incorrect Authorization
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. In version 1.7.2, an authorization guard to Users::change_password(), was added to address a previous authorization flaw that allowed a secondary administrator
- 7.5 High severity
InvoicePlane: Incorrect Authorization
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane fails to revoke administrative privileges after a role downgrade because Admin_Controller trusts the user_type snapshot stored in a
- 7.5 High severity
InvoicePlane: Improper Limitation of a Pathname to a Restricted Directory
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane's Invoices::generate_xml() method appends a database-derived xml_id to the XMLconfigs helper directory and includes the resulting P
- 7.5 High severity
InvoicePlane: Improper Limitation of a Pathname to a Restricted Directory
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane exposes Invoices::delete() and Invoices::delete_invoice_tax() as state-changing routes without requiring POST and validating a CSRF
- 9.1 Critical severity
InvoicePlane: Improper Control of Filename for Include/Require Statement in PHP Program
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2-rc-1, InvoicePlane builds its permitted template list by scanning a PHP template directory that can be written through an administrator-controlle
- 7.2 High severity
InvoicePlane: Improper Neutralization of Special Elements used in an SQL Command
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane interpolates the administrator-controlled tax_rate_decimal_places setting into an ALTER TABLE statement for ip_tax_rates in Setting
- 9.1 Critical severity
InvoicePlane: Improper Control of Generation of Code
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A critical Remote Code Execution (RCE) vulnerability exists in InvoicePlane 1.7.0 through a chained Local File Inclusion (LFI) and Log Poisoning attack. An auth
- 7.5 High severity
InvoicePlane: Improper Neutralization of Input During Web Page Generation
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting (XSS) vulnerability occurs in the upload Login Logo functions of InvoicePlane version 1.7.0. In the Upload Login Logo, the applica
- 7.5 High severity
InvoicePlane: Improper Neutralization of Input During Web Page Generation
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting (XSS) vulnerability occurs in the Edit Invoices functions of InvoicePlane version 1.7.0. When editing invoices, the application do
- 7.5 High severity
InvoicePlane: Improper Neutralization of Input During Web Page Generation
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting (XSS) vulnerability occurs in the upload Invoice Logo functions of InvoicePlane version 1.7.0. The Upload Invoice Logo function al
- 7.5 High severity
InvoicePlane: Improper Neutralization of Input During Web Page Generation
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting (XSS) vulnerability occurs in the Edit Quotes functions of InvoicePlane version 1.7.0. In the Editing Quotes function, the applica
- 7.5 High severity
InvoicePlane: Improper Limitation of a Pathname to a Restricted Directory
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A path traversal vulnerability exists in the `get_file` method of the `Guest` module's `Get` controller in InvoicePlane up to and including through 1.6.3. The v
- 9.9 Critical severity
Invoiceplane: Incomplete Identification of Uploaded File Variables (PHP)
File upload vulnerability in InvoicePlane through 1.6.3 allows authenticated attackers to upload arbitrary PHP files into attachments, which can later be executed remotely, leading to Remote Code Execution (RCE).
- 9.8 Critical severity
Invoiceplane: Unrestricted Upload of File with Dangerous Type
InvoicePlane (all versions tested as of December 2024) v.1.6.11 and before contains a remote code execution vulnerability in the upload_file method of the Upload controller.
- 8.8 High severity
InvoicePlane: Improper Access Control
A vulnerability was found in InvoicePlane up to 1.6.1. It has been declared as critical. This vulnerability affects the function upload_file of the file /index.php/upload/upload_file/1/1. The manipulation of the argument file leads to unrestricted upload. The