PT-2026-20546 · Unknown · Invoiceplane

Lagathos · Publicado 2026-02-18 · Atualizado 2026-02-24 · CVE-2026-25548

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Crítica

Vetor base

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions InvoicePlane versions 1.7.0 through 1.7.0

Description InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A critical Remote Code Execution (RCE) issue exists through a chained Local File Inclusion (LFI) and Log Poisoning attack. An authenticated administrator can execute arbitrary system commands on the server by manipulating the public invoice template setting to include poisoned log files containing PHP code. The vulnerability involves manipulating the public invoice template setting.

Recommendations Update InvoicePlane to version 1.7.1.

Exploit

Correção

RCE

Code Injection

Enumeração de Fraquezas

CWE-117

CWE-94

CWE-98

Identificadores relacionados

CVE-2026-25548

GHSA-G6RW-M9MF-33CH

Produtos afetados

Invoiceplane

Referências · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25548.json · Exploit
• https://github.com/InvoicePlane/InvoicePlane/commit/93622f2df88a860d89bfee56012cabb2942061d6 · Correção
• https://github.com/InvoicePlane/InvoicePlane/security/advisories/GHSA-g6rw-m9mf-33ch · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-25548 · Nota de Segurança
• https://twitter.com/pulsepatchio/status/2024498553708535920 · Publicação no Twitter
• https://t.me/CVEtracker/45032 · Publicação no Telegram
• https://twitter.com/CVEnew/status/2026265081688764607 · Publicação no Twitter
• https://twitter.com/infoflowcloud/status/2026266511346639109 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-25548 · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/2024287039617712336 · Publicação no Twitter