InvoicePlane anfällig für Remote Code Execution über Local File Inclusion und Log Poisoning

The impact of CVE-2026-25548 is severe. A successful exploit allows an attacker, with administrator privileges, to gain complete control over the InvoicePlane server. This includes the ability to read, modify, and delete any data accessible to the web server user. Sensitive financial data, client information, and potentially database credentials are all at risk. Lateral movement within the network is possible if the server has access to other systems. The blast radius extends to all data stored and processed by the InvoicePlane instance, and potentially beyond if the compromised server is used as a launchpad for further attacks.

Organizations using InvoicePlane for invoice management, particularly those with self-hosted deployments and administrator accounts that are not adequately secured, are at significant risk. Shared hosting environments where multiple users share the same server instance are also particularly vulnerable, as a compromise of one user's InvoicePlane installation could potentially affect others.

• linux / server:

journalctl -u invoiceplane | grep -i "php code injection"

• generic web:

curl -I http://your-invoiceplane-server.com/public_invoice_template | grep -i "Content-Type: text/plain"

• php: Check the InvoicePlane configuration files for any unusual or unexpected entries in the publicinvoicetemplate setting. Look for suspicious file paths or attempts to include external files.

1. 2026-02-18Disclosure

   disclosure

1. Reserviert2026-02-02
2. Veröffentlicht2026-02-18
3. Geändert2026-02-19
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2026-25548 is to immediately upgrade InvoicePlane to version 1.7.1 or later. If upgrading is not immediately feasible, consider implementing temporary workarounds. Restrict file upload permissions to prevent malicious file uploads. Implement strict input validation and sanitization to prevent LFI and log injection attacks. Web Application Firewalls (WAFs) can be configured to detect and block attempts to exploit this vulnerability by monitoring for suspicious file inclusion patterns. After upgrading, confirm the fix by attempting to trigger the vulnerable functionality with a known malicious payload and verifying that it is blocked.