CVE-2026-50547: Invoiceplane

High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days.

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane's Invoices::generate_xml() method appends a database-derived xml_id to the XMLconfigs helper directory and includes the resulting PHP path without validating the identifier. A low-privileged attacker who can influence the e-invoice configuration can use traversal sequences to include an existing PHP file. The standalone advisory establishes local file inclusion; code execution requires a separate file-upload or file-write primitive. This issue is fixed in version 1.7.2.

Affected products

• Invoiceplane Invoiceplane: before 1.7.2 (fixed in 1.7.2)

Published 2026-09-25. Last modified 2026-09-28.