CVE-2026-39372: InvoicePlane: Sensitive Information Disclosure via Unstripped EXIF Metadata in Attachments
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane stores and serves uploaded image attachments without stripping EXIF metadata. When an administrator uploads an image through invoice attachments, quote attachments, or another attachment feature and shares it with another user, the recipient can retrieve embedded GPS coordinates, timestamps, and device information. The preserved metadata can disclose private location and device details across users. This vulnerability is fixed in 1.7.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
InvoicePlaneto a version that resolves this vulnerability.Fixed in 1.7.2
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users who receive image attachments uploaded by an administrator are exposed to any GPS coordinates, timestamps, and device information embedded in those images. The affected upload paths include invoice attachments, quote attachments, and other attachment features.
What access does an attacker need to obtain the disclosed information?
The attacker needs access as a recipient of a shared image attachment. Exploitation does not require user interaction beyond obtaining and examining the attachment, but uploading the affected image requires administrator privileges.
Are default image uploads affected?
Affected versions store and serve uploaded image attachments without stripping EXIF metadata. Any uploaded image that already contains EXIF data may expose that data when shared with another user.
How can I tell whether existing attachments may have exposed information?
Review image attachments uploaded before upgrading and inspect them for embedded EXIF metadata, including GPS coordinates, timestamps, and device details. Attachments shared with other users may already have disclosed this information.
What version fixes the issue?
InvoicePlane 1.7.2 fixes the issue.