CVE-2026-85290

InvoicePlane 1.7.2-beta-1 stores client_email without enforcing email syntax and renders it unescaped inside double-quoted value attributes in the invoice and quote mailer forms. An administrator who can edit a client can store attribute-breaking input, and when the mailer is configured, JavaScript executes when another authenticated administrator opens the related mailer page. Fixed in version 1.7.2.

Prior to 1.7.2, InvoicePlane's User_Controller compares the session user_type value with the required role using PHP's loose inequality operator. Under a non-standard session backend that returns unexpected scalar types, type juggling can cause a value that is not strictly the required role to pass the authorization check. Fixed in version 1.7.2.

Prior to 1.7.2, InvoicePlane's Users::change_password() method accepts a user_id from the URL and updates that account's password without an object-level authorization check. An authenticated secondary administrator can target the primary administrator account and replace its password without knowing the current password. Fixed in version 1.7.2.

Prior to 1.7.2, InvoicePlane omits ensure_valid_post_request() from delete methods including Payments::delete(), Recurring::delete(), and User_clients::delete(). Although the routes require POST, they do not validate the request's CSRF token. An attacker can submit a cross-origin form through an authenticated administrator's browser to delete financial records and other application data. Fixed in version 1.7.2.

Prior to 1.7.2, InvoicePlane exposes Recurring::stop() as a state-changing GET route without CSRF token validation. When an authenticated administrator loads attacker-controlled content that requests /invoices/recurring/stop/{id}, the application stops the selected recurring invoice. An attacker can target multiple identifiers to interrupt recurring billing and cause financial loss. Fixed in version 1.7.2.

Prior to 1.7.2, InvoicePlane stores an administrator-controlled custom_field_table value without validating it against the allowed custom-field table names. Mdl_custom_fields::used() later concatenates that stored value into the FROM table and WHERE column identifier positions, so opening the custom-field edit form executes a second-order SQL injection. The injection can query arbitrary schema data and can cause application errors or denial of service. Fixed in version 1.7.2.

InvoicePlane before version 1.7.2: Invoices::generate_xml() appends a database-derived xml_id to the XMLconfigs helper directory and includes the resulting PHP path without validating the identifier. A low-privileged attacker who can influence the e-invoice configuration can use traversal sequences to include an existing PHP file. Code execution requires a separate file-upload or file-write primitive.

InvoicePlane before version 1.7.2 exposes Invoices::delete() and Invoices::delete_invoice_tax() as state-changing routes without requiring POST and validating a CSRF token. When an authenticated administrator loads attacker-controlled content that requests an affected route, the application can delete an invoice or invoice tax record. The cross-origin action can remove financial data without the administrator's intent.

InvoicePlane before version 1.7.2 stores and serves uploaded images without stripping EXIF metadata. When an administrator shares an image with another user, the recipient can retrieve GPS coordinates, timestamps, and device information. The vulnerability is fixed in version 1.7.2.

In InvoicePlane prior to 1.7.2, the administrator-controlled tax_rate_decimal_places setting is interpolated into an ALTER TABLE statement for ip_tax_rates in Settings::index() without strict integer validation. A crafted setting value can add clauses to the schema-changing statement and remove or alter required database columns. The vulnerability is fixed in 1.7.2.