CVE-2026-39353: InvoicePlane Template RCE Vulnerability

CVE-2026-39353 Overview

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Versions prior to 1.7.2-rc-1 build the permitted template list by scanning a PHP template directory that can be written through an administrator-controlled file-write capability. A malicious PHP file placed in the directory is automatically trusted by Mdl_templates and can be selected as public_invoice_template. When a public invoice is rendered, the guest View controller includes the trusted file and executes it with web-server privileges. The issue is fixed in 1.7.2-rc-1 and is classified under [CWE-98] (Improper Control of Filename for Include/Require Statement in PHP Program).

Critical Impact
An authenticated administrator can plant a PHP file in the templates directory and trigger execution by any unauthenticated visitor loading a public invoice, resulting in remote code execution under the web-server user.

Affected Products

InvoicePlane versions prior to 1.7.2-rc-1
Self-hosted InvoicePlane deployments exposing public invoice URLs
Any environment where administrator accounts have file-write access to the PHP template directory

Discovery Timeline

2026-09-25 - CVE-2026-39353 published to NVD
2026-09-28 - Last updated in NVD database

Technical Details for CVE-2026-39353

Vulnerability Analysis

The flaw sits in how InvoicePlane enumerates allowed invoice templates. The Mdl_templates model scans a filesystem directory and treats every PHP file inside it as a valid template choice. There is no allowlist, signature check, or separation between static template assets and executable PHP code.

Because the administrator interface exposes a file-write primitive that targets the same directory, a privileged user can introduce arbitrary PHP into the trusted set. Setting public_invoice_template to the malicious filename weaponizes any subsequent public invoice request. The guest View controller resolves the configured template and performs a PHP include, which evaluates the file in the context of the web server.

The attack crosses a trust boundary: a post-authentication administrative capability becomes an unauthenticated code execution path at the guest invoice endpoint. The scope change is reflected in the vector string, where exploitation impacts resources beyond the administrator's own context.

Root Cause

The root cause is unsafe inclusion of user-controlled filenames. Mdl_templates derives its template list from directory contents rather than from a vetted registry, and the include target is driven by a database-stored setting that an administrator can write. Combined with a writable template directory, this produces a classic PHP file inclusion issue [CWE-98].

Attack Vector

Exploitation requires an administrator account to drop a PHP payload into the template directory and set it as the active public_invoice_template. Once configured, any unauthenticated user that loads the corresponding public invoice URL triggers execution of the planted code with web-server privileges. The attack is network-reachable and requires no user interaction at the victim side.

php

// Patch excerpt - application/core/XSS_Protection_Trait.php
protected function filter_input(): void
{
    // Load file_security helper early so sanitize_for_logging() is always available,
    // even when XSS modification is detected before the logging block is reached.
    $this->load->helper('file_security');

    // Fields that should bypass XSS sanitization
    $bypass_fields = [
        'user_password',      // User password fields need to allow special characters

Source: GitHub InvoicePlane Commit 00e599d

Detection Methods for CVE-2026-39353

Indicators of Compromise

New or modified .php files inside the InvoicePlane templates directory that do not match files shipped in the official release.
Changes to the public_invoice_template setting in the InvoicePlane database that reference unfamiliar template filenames.
Web-server process spawning shells, package managers, or outbound network connections while servicing /invoices/view/ or equivalent public invoice routes.

Detection Strategies

Compare the templates directory against a known-good manifest from the installed InvoicePlane release and alert on drift.
Enable PHP logging and audit include/require calls originating from the guest View controller for unexpected target paths.
Review administrator audit logs for template upload or configuration changes that precede inbound requests to public invoice URLs.

Monitoring Recommendations

Monitor child-process creation from the PHP-FPM or Apache worker user, particularly interpreters and reconnaissance utilities.
Alert on write operations to the templates directory outside of planned upgrade windows.
Track outbound connections from the web host to unknown destinations following public invoice rendering.

How to Mitigate CVE-2026-39353

Immediate Actions Required

Upgrade InvoicePlane to version 1.7.2-rc-1 or later as published in the InvoicePlane v1.7.2-rc-1 release.
Audit the templates directory and remove any PHP files not provided by the official release.
Rotate administrator credentials and review account activity for unauthorized template or settings changes.

Patch Information

The fix is delivered in InvoicePlane 1.7.2-rc-1 via the changes in InvoicePlane commit 00e599d and pull request #1536. Additional context is available in GitHub Security Advisory GHSA-v735-2x3r-gwpp.

Workarounds

Make the templates directory read-only for the web-server user until the patched release is deployed.
Restrict administrator access to trusted operators and enforce multi-factor authentication on administrative logins.
Place the public invoice endpoint behind an authenticated reverse proxy or IP allowlist to reduce unauthenticated exposure.

bash

# Example: enforce read-only permissions on the templates directory
chown -R root:www-data /var/www/invoiceplane/application/views/invoice_templates/pdf
chmod -R 0750 /var/www/invoiceplane/application/views/invoice_templates/pdf
find /var/www/invoiceplane/application/views/invoice_templates/pdf -type f -name '*.php' -exec chmod 0640 {} \;