CVE-2026-39372: InvoicePlane EXIF Data Disclosure Flaw

CVE-2026-39372 Overview

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Versions prior to 1.7.2 store and serve uploaded image attachments without stripping Exchangeable Image File Format (EXIF) metadata. When an administrator uploads an image through invoice attachments, quote attachments, or another attachment feature and shares it with another user, the recipient can retrieve embedded GPS coordinates, timestamps, and device information. The preserved metadata can disclose private location and device details across users. This issue is tracked as [CWE-200] Information Exposure and is fixed in InvoicePlane 1.7.2.

Critical Impact
Authenticated recipients of shared image attachments can extract GPS coordinates, capture timestamps, and device identifiers belonging to the uploader, exposing physical location and device fingerprint data.

Affected Products

InvoicePlane versions prior to 1.7.2
Self-hosted InvoicePlane deployments using invoice, quote, or generic attachment features
InvoicePlane logo upload functionality in application/modules/settings

Discovery Timeline

2026-09-25 - CVE CVE-2026-39372 published to NVD
2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-39372

Vulnerability Analysis

The vulnerability stems from InvoicePlane accepting user-supplied image files and persisting them to disk without sanitizing embedded metadata. EXIF segments routinely carry GPS latitude and longitude, capture device model, serial number, firmware version, software identifiers, and precise timestamps. When a privileged user attaches a photograph to an invoice or quote and that attachment is served to another user, the recipient downloads the untouched file. Any image metadata viewer can then extract sensitive fields.

Because the attack vector is network-based and no user interaction is required to parse the metadata, the recipient needs only to retrieve the attachment through normal application workflows. The exposure crosses trust boundaries between administrator and lower-privileged recipients.

Root Cause

The upload handlers in application/modules/upload/controllers/Upload.php and the logo handler in application/modules/settings/controllers/Settings.php moved uploaded files to their final storage path without invoking any metadata-stripping routine. The application lacked a helper such as strip_exif_metadata() prior to the 1.7.2 release.

Attack Vector

An authenticated administrator uploads an image taken by a mobile device or digital camera. InvoicePlane stores the file as-is. A second user with access to the invoice, quote, or attachment resource downloads the file through the application. Using any EXIF tool, the recipient reads GPS coordinates and device identifiers belonging to the uploader.

php

// Security patch in application/modules/upload/controllers/Upload.php
} elseif ( ! move_uploaded_file($tempFile, $filePath)) {
    respond_file_message(400, 'upload_error_invalid_move_uploaded_file', $filename);
}

// Security: Strip EXIF metadata from uploaded images to prevent privacy leaks
$this->strip_image_metadata($filePath, $filename);
}

private function strip_image_metadata(string $filePath, string $filename): void
{
    $result = strip_exif_metadata($filePath);

    if ( ! $result['success'] && ! isset($result['skipped'])) {
        // Log the error but don't fail the upload - the file is already uploaded
        log_message('warning', 'Failed to strip EXIF metadata from uploaded file: ' . sanitize_for_logging($filename) . ' - Error: ' . $result['error']);
    } elseif ($result['success'] && ! isset($result['skipped'])) {
        // Successfully stripped EXIF metadata
        log_message('debug', 'EXIF metadata stripped from uploaded file: ' . sanitize_for_logging($filename));
    }
}

Source: GitHub Commit 90381b4

Detection Methods for CVE-2026-39372

Indicators of Compromise

Image attachments on InvoicePlane servers whose EXIF segment contains GPSLatitude, GPSLongitude, Make, Model, or DateTimeOriginal fields.
Access log entries showing non-administrator accounts downloading image attachments previously uploaded by administrators.
Presence of unmodified JPEG, TIFF, or HEIC files under the InvoicePlane uploads directory on versions prior to 1.7.2.

Detection Strategies

Scan the InvoicePlane uploads directory with exiftool to identify stored images that still carry GPS or device metadata.
Compare installed version strings in application/config/version.php against the fixed release 1.7.2.
Review download audit logs for cross-user access to image attachments uploaded before patching.

Monitoring Recommendations

Alert when image files are added to the InvoicePlane storage path without a corresponding metadata-stripping log entry.
Monitor web server access logs for HTTP GET requests to attachment endpoints from accounts other than the uploader.
Track application warning log entries referencing Failed to strip EXIF metadata after the upgrade to confirm the sanitizer is executing.

How to Mitigate CVE-2026-39372

Immediate Actions Required

Upgrade InvoicePlane to version 1.7.2 or later, which introduces the strip_exif_metadata() helper in the upload and settings controllers.
Audit existing image attachments and re-process them with an EXIF-stripping tool to remove residual metadata from files uploaded before the patch.
Restrict administrator accounts to uploading images that have already been sanitized at the source, particularly those originating from mobile devices.

Patch Information

The fix is delivered in InvoicePlane Release v1.7.2 and merged through GitHub Pull Request #1507. See GitHub Security Advisory GHSA-7j67-2v6p-275v for the coordinated disclosure details. Note that per the commit description, the EXIF stripping feature is optional and may be disabled by default in some configurations; verify the setting is enabled after upgrading.

Workarounds

Preprocess all images with exiftool -all= <file> before uploading them to InvoicePlane.
Disable image attachment features for invoices, quotes, and the logo upload until the upgrade can be applied.
Limit attachment visibility so that only the uploader can retrieve image files, reducing cross-user exposure.

bash

# Configuration example: bulk strip EXIF metadata from existing InvoicePlane uploads
find /var/www/invoiceplane/uploads -type f \( -iname '*.jpg' -o -iname '*.jpeg' -o -iname '*.tiff' -o -iname '*.heic' \) \
  -exec exiftool -overwrite_original -all= {} \;