Skip to content
OpenAdvisories

Vendor

InvoicePlane

27 known vulnerabilities.

Products

InvoicePlane 27
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Critical 9.1
    CVE-2026-39353

    InvoicePlane: Remote Code Execution via Writable Templates Directory

    InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2-rc-1, InvoicePlane builds its permitted template list by scanning a PHP template directory that can be written through an administrator-controll…

    InvoicePlane InvoicePlane
  • Critical 9.1
    CVE-2026-25548 Public exploit

    InvoicePlane Vulnerable to Remote Code Execution via Local File Inclusion and Log Poisoning

    InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A critical Remote Code Execution (RCE) vulnerability exists in InvoicePlane 1.7.0 through a chained Local File Inclusion (LFI) and Log Poisoning attack. An aut…

    InvoicePlane InvoicePlane
  • Critical 9.3
    CVE-2026-23491 Public exploit Scanner template

    InvoicePlane has Unauthenticated Path Traversal in Guest Controller

    InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A path traversal vulnerability exists in the `get_file` method of the `Guest` module's `Get` controller in InvoicePlane up to and including through 1.6.3. The …

    InvoicePlane InvoicePlane