PT-2026-20546 · Unknown · Invoiceplane

Lagathos · Published 2026-02-18 · Updated 2026-02-24 · CVE-2026-25548

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions InvoicePlane versions 1.7.0 through 1.7.0

Description InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A critical Remote Code Execution (RCE) issue exists through a chained Local File Inclusion (LFI) and Log Poisoning attack. An authenticated administrator can execute arbitrary system commands on the server by manipulating the public invoice template setting to include poisoned log files containing PHP code. The vulnerability involves manipulating the public invoice template setting.

Recommendations Update InvoicePlane to version 1.7.1.

Exploit

Fix

RCE

Code Injection

Weakness Enumeration

CWE-117

CWE-94

CWE-98

Related Identifiers

CVE-2026-25548

GHSA-G6RW-M9MF-33CH

Affected Products

Invoiceplane

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25548.json · Exploit
• https://github.com/InvoicePlane/InvoicePlane/commit/93622f2df88a860d89bfee56012cabb2942061d6 · Patch
• https://github.com/InvoicePlane/InvoicePlane/security/advisories/GHSA-g6rw-m9mf-33ch · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25548 · Security Note
• https://osv.dev/vulnerability/CVE-2026-25548 · Vendor Advisory
• https://twitter.com/pulsepatchio/status/2024498553708535920 · Twitter Post
• https://t.me/CVEtracker/45032 · Telegram Post
• https://twitter.com/CVEnew/status/2026265081688764607 · Twitter Post
• https://twitter.com/infoflowcloud/status/2026266511346639109 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2024287039617712336 · Twitter Post