CVE-2026-85290: InvoicePlane Log Injection Vulnerability

CVE-2026-85290 Overview

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Versions prior to 1.7.2 contain a log injection vulnerability [CWE-117] in the Cron::recur() method. The method writes an invalid cron_key value from the URL path directly to the application log without neutralizing carriage return and line feed (CRLF) characters. An unauthenticated requester can forge log entries by supplying a crafted cron_key value. The injected entries can corrupt forensic records and interfere with log-based monitoring tools. The issue is fixed in version 1.7.2.

Critical Impact
Unauthenticated attackers can inject forged entries into the InvoicePlane audit log, undermining the integrity of forensic records and log-based detection pipelines.

Affected Products

InvoicePlane versions prior to 1.7.2
Self-hosted deployments exposing the cron endpoint to the network
Environments relying on InvoicePlane logs for audit or SIEM ingestion

Discovery Timeline

2026-09-25 - CVE-2026-85290 published to NVD
2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-85290

Vulnerability Analysis

The vulnerability resides in the Cron::recur() controller inside application/modules/invoices/controllers/Cron.php. When the supplied cron_key does not match the configured value, the controller logs the rejected key verbatim using log_message('error', ...). Because the raw request value is concatenated into the log line, an attacker can embed CRLF sequences and arbitrary text to append fabricated entries.

The endpoint does not require authentication, so any network-reachable requester can trigger the logging path by sending a request with a wrong cron_key. Forged lines can impersonate legitimate error messages, mask malicious activity, or poison downstream log parsers that trust line-oriented input.

The impact is limited to log integrity. Confidentiality and availability are not affected, but corrupted audit trails can hinder incident response and defeat detections built on log patterns.

Root Cause

The root cause is improper output neutralization for logs [CWE-117]. The controller trusted attacker-controlled input and placed it directly into a log statement without stripping or encoding newline characters.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. An attacker issues an HTTP request to the cron endpoint with a cron_key value containing CRLF sequences and forged log content. The server writes the attacker-controlled bytes to the application log file, producing synthetic entries that appear authentic.

php

     {
         // Check the provided cron key
         if ( ! hash_equals((string) get_setting('cron_key'), (string) $cron_key)) {
-            log_message('error', '[Cron Recurring Invoices] Wrong cron key provided! ' . $cron_key);
+            $this->load->helper('file_security');
+            log_message('error', '[Cron Recurring Invoices] Wrong cron key provided! '
+                . sanitize_for_logging((string) $cron_key));
             show_error(trans('wrong_cron_key_provided'), 500);
             exit('Wrong cron key!');
         }

Source: InvoicePlane patch commit 97fd1b6. The patch loads the file_security helper and routes the untrusted cron_key through sanitize_for_logging() before writing it to the log.

Detection Methods for CVE-2026-85290

Indicators of Compromise

Repeated requests to the InvoicePlane cron endpoint containing unusual cron_key values or URL-encoded CRLF sequences (%0d%0a)
Application log lines containing [Cron Recurring Invoices] Wrong cron key provided! followed by unexpected multi-line content
Log entries whose timestamps or severity prefixes do not match the surrounding formatting pattern

Detection Strategies

Parse InvoicePlane error logs for consecutive lines originating from a single Cron::recur() event and flag mismatched structure
Alert on web access logs showing non-matching cron_key values from unauthenticated sources, particularly those containing encoded newlines
Correlate SIEM ingestion anomalies against spikes in requests to the cron URL

Monitoring Recommendations

Enable integrity monitoring on the InvoicePlane log directory to detect tampering patterns
Forward InvoicePlane logs to a centralized platform that preserves raw bytes for forensic review
Rate-limit or restrict network access to the cron endpoint and alert on repeated authentication failures

How to Mitigate CVE-2026-85290

Immediate Actions Required

Upgrade InvoicePlane to version 1.7.2 or later, which sanitizes the cron_key input before logging
Restrict network access to the cron endpoint using firewall rules or web server access controls
Review existing InvoicePlane logs for signs of injected entries and preserve originals for investigation

Patch Information

The fix is included in InvoicePlane Release v1.7.2. Technical details are documented in GitHub Security Advisory GHSA-g53q-v2pv-xr83 and Pull Request 1639. The patch introduces a sanitize_for_logging() helper call that strips CRLF characters before the value is passed to log_message().

Workarounds

Place the InvoicePlane cron endpoint behind an authenticated reverse proxy or allowlist of trusted IP addresses
Rotate the cron_key value and ensure it is complex enough to discourage brute force attempts that would also trigger the logging path
Configure the web server to reject requests containing encoded CRLF sequences in the URL path or query string

bash

# Example nginx rule to drop requests containing encoded CRLF in the cron path
location ~* ^/index\.php/invoices/cron/recur/ {
    if ($request_uri ~* "%0d|%0a|\r|\n") {
        return 400;
    }
    allow 10.0.0.0/8;
    deny all;
}