CVE-2026-33639: InvoicePlane permits DDL injection through tax_rate_decimal_places
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane interpolates the administrator-controlled taxratedecimalplaces setting into an ALTER TABLE statement for iptaxrates in Settings::index() without strict integer validation. A crafted setting value can add clauses to the schema-changing statement and remove or alter required database columns. The resulting schema corruption can permanently modify financial data structures and make the application unavailable. This vulnerability is fixed in 1.7.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
InvoicePlaneto a version that resolves this vulnerability.Fixed in 1.7.2
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker needs administrator-level access to change the tax_rate_decimal_places setting. It is therefore most relevant where administrative accounts are compromised, improperly shared, or accessible to untrusted users.
Which deployments are affected?
InvoicePlane versions prior to 1.7.2 are affected. The vulnerable path is the administrator-controlled tax_rate_decimal_places setting used while changing the ip_tax_rates table schema.
What is the impact of successful exploitation?
A crafted setting can inject additional clauses into an ALTER TABLE statement. This can remove or modify required database columns, permanently corrupt financial data structures, and make the application unavailable.
What should be done if upgrading cannot happen immediately?
Restrict access to administrator accounts and prevent untrusted users from changing tax_rate_decimal_places. Because exploitation can permanently alter the database schema, ensure current, tested database backups are available before administrators modify this setting.
How can administrators check for possible exploitation?
Review the ip_tax_rates schema for missing or unexpectedly altered columns and investigate recent changes to tax_rate_decimal_places. Database backups or schema records can help identify deviations from the expected structure.