CVE-2026-54790: InvoicePlane: Second-order SQL injection through the unvalidated custom_field_table field in the Custom Fields module
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane stores an administrator-controlled customfieldtable value without validating it against the allowed custom-field table names. Mdlcustomfields::used() later concatenates that stored value into the FROM table and WHERE column identifier positions, so opening the custom-field edit form executes a second-order SQL injection. The injection can query arbitrary schema data and can cause application errors or denial of service. This issue is fixed in version 1.7.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
InvoicePlaneto a version that resolves this vulnerability.Fixed in 1.7.2
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs administrator-level privileges to set the custom_field_table value in the Custom Fields module. The injected SQL is triggered later when the custom-field edit form is opened.
Which deployments are affected?
InvoicePlane versions prior to 1.7.2 are affected. The issue requires use of the Custom Fields module and an administrator-controlled custom_field_table value that is not restricted to allowed table names.
What is the impact of successful exploitation?
The injection can query arbitrary database schema data. It can also produce application errors or denial of service.
What should be done if an immediate upgrade is not possible?
Restrict administrator access to trusted users and review custom_field_table values in the Custom Fields module for unexpected or invalid table names. Avoid opening custom-field edit forms associated with suspicious values until they are corrected.
How can an organization determine whether it is exposed?
Check the InvoicePlane version and upgrade to 1.7.2 if it is older. For older installations, inspect Custom Fields configuration for custom_field_table entries that are not allowed custom-field table names.