CVE-2026-25548

The attack consists of a chain of two techniques: first, the attacker poisons log files (log poisoning) by injecting malicious PHP code into them, then forces the application to load these files. This is possible due to manipulation of the `public_invoice_template` setting, which controls the invoice template path — the application does not properly validate this value (CWE-98), leading to Local File Inclusion of the poisoned log and execution of the PHP code embedded in it (CWE-94). An additional problem is insufficient sanitization of data written to logs (CWE-117), which enables effective poisoning of the log file.

An authenticated administrator can execute arbitrary system commands on the server, which in practice means complete takeover of the system, possibility of data theft, installation of backdoors, or further lateral movement in the infrastructure.

InvoicePlane should be updated to version 1.7.1, which contains a fix for the described vulnerability. Patch details are available in the project's GitHub repository (commit 93622f2df88a860d89bfee56012cabb2942061d6) and in the official security advisory GHSA-g6rw-m9mf-33ch.

InvoicePlane version 1.7.0