External risk intelligence

InvoicePlane Arbitrary File Upload and Execution Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-39353

InvoicePlane is a self-hosted web application designed to manage invoices, clients, and payments. Such applications are commonly deployed as internet-facing services to allow clients to access and pay invoices online, making the web interface and associated invoice rendering endpoints directly reachable from the public internet.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This CVE involves a vulnerability in InvoicePlane, an open-source application used for managing invoices and payments. The issue could allow unauthorized execution of code with web-server privileges if an attacker can place a malicious file in a specific directory accessible through an administrator function. This could lead to significant compromise of the application and its environment.

A flaw in invoice software allows code execution.
Affects self-hosted invoice management applications.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker with administrative access could upload a malicious PHP file through an existing file-write capability. InvoicePlane then automatically trusts this file, allowing it to be selected as a public invoice template. When a public invoice is viewed, the system executes the malicious file with web-server privileges, potentially leading to significant compromise.

Requires administrative access to upload a file.
Malicious PHP file placed in a trusted directory.
Arbitrary code execution with web-server privileges.

Live Threat

Current exploitation, exposure, and threat context

When an administrator-controlled file-write capability is used to upload a malicious PHP file to a specific directory, and when that file is later rendered as a public invoice, it could be executed with web-server privileges. This could impact the application's ability to manage invoices, clients, and payments.

System data and service behavior at risk.
Malicious PHP file execution via template system.
Unauthorized code execution on the web server.

Operational Fix

Recommended remediation, mitigation, and detection steps

InvoicePlane is a self-hosted application, likely managed by application owners or an infrastructure team responsible for its deployment and maintenance. The first practical step is to identify all instances of InvoicePlane within your environment, confirm their reachability and business criticality, and then locate the accountable owner for each instance before planning remediation.

Application owners should prioritize this.
Verify all InvoicePlane deployments.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is InvoicePlane and what is it used for?

InvoicePlane is a self-hosted, open-source software application designed to help businesses manage their billing lifecycle. It provides tools for creating and tracking invoices, managing client databases, and processing payments directly through a web-based interface.

What does CWE-98 mean for CVE-2026-39353?

This CVE involves a vulnerability classified as CWE-98, which refers to improper control of file inclusion. In plain terms, the software incorrectly trusts and executes files it finds in a specific directory. Because the application automatically treats these files as valid templates, an attacker can trick the system into running unauthorized code instead of a legitimate invoice document.

How is this vulnerability triggered in InvoicePlane?

An attacker must first use an existing administrator-level feature to upload a malicious PHP file into the system's template directory. The bug is not triggered by simply uploading a file; it only executes when the application later attempts to render that specific file as a public invoice. Files that are uploaded but never selected as a template will not cause this execution.

Who should care about CVE-2026-39353?

Anyone hosting an instance of InvoicePlane should care, especially because Halo Surface Signal notes these applications are frequently deployed as internet-facing services. Because the web interface and invoice rendering endpoints are often directly reachable by the public, the risk of unauthorized access is higher if your instance is exposed to the open web.

What are the first steps to secure my environment?

Begin by auditing your network to identify all running instances of InvoicePlane and determine who owns each deployment. Once identified, evaluate their exposure levels and ensure they are patched to version 1.7.2-rc-1 or later. Prioritize updating instances that are accessible from the internet to close the path for potential code execution.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.