CVE-2026-100392

InvoicePlane 1.7.2-beta-1 stores client_email without enforcing email syntax and renders it unescaped inside double-quoted value attributes in the invoice and quote mailer forms. An administrator who can edit a client can store attribute-breaking input, and when the mailer is configured, JavaScript executes when another authenticated administrator opens the related mailer page. Fixed in version 1.7.2.

Prior to 1.7.2, InvoicePlane's User_Controller compares the session user_type value with the required role using PHP's loose inequality operator. Under a non-standard session backend that returns unexpected scalar types, type juggling can cause a value that is not strictly the required role to pass the authorization check. Fixed in version 1.7.2.

Prior to 1.7.2, InvoicePlane's Users::change_password() method accepts a user_id from the URL and updates that account's password without an object-level authorization check. An authenticated secondary administrator can target the primary administrator account and replace its password without knowing the current password. Fixed in version 1.7.2.

Prior to 1.7.2, InvoicePlane omits ensure_valid_post_request() from delete methods including Payments::delete(), Recurring::delete(), and User_clients::delete(). Although the routes require POST, they do not validate the request's CSRF token. An attacker can submit a cross-origin form through an authenticated administrator's browser to delete financial records and other application data. Fixed in version 1.7.2.

Prior to 1.7.2, InvoicePlane exposes Recurring::stop() as a state-changing GET route without CSRF token validation. When an authenticated administrator loads attacker-controlled content that requests /invoices/recurring/stop/{id}, the application stops the selected recurring invoice. An attacker can target multiple identifiers to interrupt recurring billing and cause financial loss. Fixed in version 1.7.2.

Prior to 1.7.2, InvoicePlane stores an administrator-controlled custom_field_table value without validating it against the allowed custom-field table names. Mdl_custom_fields::used() later concatenates that stored value into the FROM table and WHERE column identifier positions, so opening the custom-field edit form executes a second-order SQL injection. The injection can query arbitrary schema data and can cause application errors or denial of service. Fixed in version 1.7.2.

InvoicePlane before version 1.7.2: Invoices::generate_xml() appends a database-derived xml_id to the XMLconfigs helper directory and includes the resulting PHP path without validating the identifier. A low-privileged attacker who can influence the e-invoice configuration can use traversal sequences to include an existing PHP file. Code execution requires a separate file-upload or file-write primitive.

InvoicePlane before version 1.7.2 exposes Invoices::delete() and Invoices::delete_invoice_tax() as state-changing routes without requiring POST and validating a CSRF token. When an authenticated administrator loads attacker-controlled content that requests an affected route, the application can delete an invoice or invoice tax record. The cross-origin action can remove financial data without the administrator's intent.

InvoicePlane version 1.4.10 is vulnerable to an Arbitrary File Upload, allowing an authenticated user to upload a malicious file to the webserver. An attacker can upload a script that can compromise the webserver.

In InvoicePlane before version 1.7.2-rc-1, the permitted template list is built by scanning a PHP template directory that can be written through an administrator-controlled file-write capability. A malicious PHP file placed in the directory is automatically trusted and can be selected as a public template, then executed when rendering a public invoice.