CVE-2026-50547: InvoicePlane permits local file inclusion through the e-invoice XML configuration identifier
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane's Invoices::generatexml() method appends a database-derived xmlid to the XMLconfigs helper directory and includes the resulting PHP path without validating the identifier. A low-privileged attacker who can influence the e-invoice configuration can use traversal sequences to include an existing PHP file. The standalone advisory establishes local file inclusion; code execution requires a separate file-upload or file-write primitive. This issue is fixed in version 1.7.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
InvoicePlaneto a version that resolves this vulnerability.Fixed in 1.7.2
Event History
Frequently Asked Questions
Who can exploit this issue?
A low-privileged authenticated attacker who can influence the e-invoice configuration is required. The attack is network-accessible and does not require user interaction.
Does local file inclusion alone give an attacker code execution?
No. The advisory establishes inclusion of an existing PHP file; code execution additionally requires a separate ability to upload or write a PHP file to a location that can be included.
What versions are affected and what is the remediation?
InvoicePlane versions before 1.7.2 are affected. Upgrade to version 1.7.2, which fixes the validation issue in the XML configuration identifier.