PT-2026-25247 · Boldgrid · Sprout Invoices Client Invoicing

Daroo · Published 2026-03-13 · Updated 2026-03-14 · CVE-2026-32401

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions BoldGrid Client Invoicing by Sprout Invoices versions through 20.8.9

Description The software suffers from improper control of filename handling for include/require statements in a PHP program, leading to a PHP Local File Inclusion issue. This allows for the inclusion of local PHP files. The vulnerable component is related to the handling of file inclusion, potentially through functions like include() or require(). The filename parameter, or a similar variable controlling file paths, is not adequately sanitized, allowing an attacker to manipulate the included file.

Recommendations Versions prior to and including 20.8.9 should be updated. As a temporary workaround, restrict access to the file inclusion functionality or sanitize all file paths before using them in include() or require() statements.

Fix

Weakness Enumeration

CWE-98

Related Identifiers

CVE-2026-32401

Affected Products

Sprout Invoices Client Invoicing

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-32401 · Security Note
• https://twitter.com/CVEnew/status/2032831450987508042 · Twitter Post
• https://patchstack.com/database/Wordpress/Plugin/sprout-invoices/vulnerability/wordpress-client-invoicing-by-sprout-invoices-plugin-20-8-9-local-file-inclusion-vulnerability?_s_id=cve · Note