CVE-2025-10009: Invoice Ninja 5

High severity, CVSS 8.6. EPSS: 0.5% chance of exploitation in the next 30 days.

Incorrect handling of uploaded files in the admin "Restore" function in Invoice Ninja <= 5.11.72 allows attackers with admin credentials to execute arbitrary code on the server via uploaded .php files.

Affected products

• Invoice Ninja Invoice Ninja 5: from 5.11.41, up to and including 5.11.72

Published 2025-09-22. Last modified 2026-06-17.