CVE-2026-85290: InvoicePlane: Log Injection via Unsanitized User Input in Cron Key Error Logging
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane's Cron::recur() method writes an invalid cron key from the URL path directly to the application log without neutralizing CRLF characters. An unauthenticated requester can place forged log lines into the audit trail by supplying a crafted cronkey value. The injected entries can corrupt forensic records and interfere with log-based monitoring. This issue is fixed in version 1.7.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
InvoicePlaneto a version that resolves this vulnerability.Fixed in 1.7.2
Event History
Frequently Asked Questions
Who can exploit this issue, and what access do they need?
Any unauthenticated requester who can send a request containing a crafted cron_key value can exploit it. No account or user interaction is required.
Which deployments are affected?
InvoicePlane versions prior to 1.7.2 are affected. The vulnerable behavior occurs when an invalid cron key supplied through the URL path is written to the application log.
What is the impact of successful exploitation?
An attacker can inject forged log entries into the application audit trail using CRLF characters. This can corrupt forensic records and disrupt monitoring that relies on log contents.
What should teams do if they cannot immediately upgrade?
The provided information identifies version 1.7.2 as the fix but does not specify a workaround. Until upgrading, treat InvoicePlane logs as potentially untrustworthy and investigate unexpected or malformed entries for possible log injection.