CVE-2026-25548: InvoicePlane Vulnerable to Remote Code Execution via Local File Inclusion and Log Poisoning
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A critical Remote Code Execution (RCE) vulnerability exists in InvoicePlane 1.7.0 through a chained Local File Inclusion (LFI) and Log Poisoning attack. An authenticated administrator can execute arbitrary system commands on the server by manipulating the publicinvoicetemplate setting to include poisoned log files containing PHP code. Version 1.7.1 patches the issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-25548?
CVE-2026-25548 is classified as a critical vulnerability due to its potential for Remote Code Execution.
What versions of InvoicePlane are affected by CVE-2026-25548?
CVE-2026-25548 affects InvoicePlane version 1.7.0, with subsequent versions up to 1.7.1 being vulnerable.
How do I mitigate CVE-2026-25548?
To mitigate CVE-2026-25548, update InvoicePlane to version 1.7.1 or later.
What type of vulnerability is CVE-2026-25548?
CVE-2026-25548 is a Remote Code Execution vulnerability exploited via Local File Inclusion.
What impact does CVE-2026-25548 have on systems using InvoicePlane?
CVE-2026-25548 allows attackers to execute arbitrary code on the server, potentially compromising the entire system.