CVE-2026-25548: InvoicePlane RCE via LFI and Log Poisoning
CVE-2026-25548 describes a critical remote code execution flaw in InvoicePlane, caused by chaining local file inclusion with log poisoning. The record states that an authenticated administrator can run system commands on the server in versions before 1.7.1, and that version 1.7.1 patches the issue. No confirmed exploitation is listed in the sources consulted, and the record gives a CVSS base score of 9.1.
Overview
InvoicePlane is a self-hosted open source application for managing invoices, clients and payments. The record describes a critical remote code execution issue that chains local file inclusion with log poisoning. The weakness is classified as CWE-94 (Code Injection).
Impact
- The record assigns a CVSS base score of 9.1 (critical), with high impact on confidentiality, integrity and availability.
- The attack is described as network-reachable with low complexity, but requires high privileges, specifically an authenticated administrator.
- The SSVC data in the record rates technical impact as total and automatable as no.
Affected products and versions
- The record lists InvoicePlane versions before 1.7.1 (up to and including 1.7.0) as affected.
- The record names version 1.7.1 as the patched release.
- The referenced commit is the patch cited by the record.
Exploitation status
- The CISA KEV catalog entry in the record is not listed, so no confirmed active exploitation is recorded for this CVE.
- No confirmed exploitation in the wild appears in the sources consulted.
- One reference in the record carries an Exploit tag. This tag does not by itself confirm real-world exploitation, and its content was not reviewed here.
- The EPSS probability in the record is about 1 percent, with a percentile of about 63 percent.
Remediation and mitigation
- Upgrade InvoicePlane to version 1.7.1 or later, which the record states patches the issue.
- If an immediate upgrade is not possible, restrict administrator accounts to the minimum number of trusted users and review who can change application settings.
- Review any configuration that controls template or file paths and ensure values cannot point to unexpected files.
- Restrict write and read access to application log files and keep them outside directories served by the web server where possible.
Detection guidance
- Audit changes to the public invoice template setting and alert on modifications made by unexpected accounts.
- Review administrator activity logs for configuration changes that occur outside normal maintenance windows.
- Inspect application and web server logs for unusual entries or content that does not match expected log formats.
- Monitor for unexpected files or includes being referenced by the application.
Limitations of the available information
- The record does not describe the exact technical steps of the chain, and this analysis does not provide them.
- The record does not list workarounds beyond the patch.
- The record does not state whether forks, customized installations or other releases are affected.
- The content of the referenced exploit-tagged resource was not reviewed.
- Scoring and EPSS values are taken from the record as provided and were not independently verified.
Sources: GitHub Security Advisory GHSA-g6rw-m9mf-33ch, patch commit, NVD entry.
Frequently asked questions
Which InvoicePlane versions are affected by CVE-2026-25548?
The record lists versions before 1.7.1, which includes 1.7.0 and earlier. The record does not give a more detailed version history.
What fixes this vulnerability?
The record states that version 1.7.1 patches the issue and references a patch commit in the InvoicePlane repository.
Is this vulnerability known to be actively exploited?
No. The CVE is not listed in the CISA KEV catalog in the record, and no confirmed exploitation in the wild appears in the sources consulted.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.