CVE-2026-25548: RCE in InvoicePlane

The impact of CVE-2026-25548 is severe. A successful exploit allows an attacker, with administrator privileges, to execute arbitrary code on the InvoicePlane server. This could lead to complete system takeover, data exfiltration, modification, or deletion. Attackers could potentially gain access to sensitive financial data, client information, and other confidential records stored within the InvoicePlane system. The ability to execute arbitrary commands also opens the door for lateral movement within the network, allowing attackers to compromise other systems connected to the InvoicePlane server. This vulnerability shares similarities with other log poisoning attacks where malicious code is injected into log files and subsequently executed by the application.

1. Reserved2026-02-02
2. Published2026-02-18
3. Modified2026-02-19
4. EPSS updated2026-03-23

The primary mitigation for CVE-2026-25548 is to immediately upgrade InvoicePlane to version 1.7.1 or later. If upgrading is not immediately feasible, consider implementing temporary workarounds. Restrict access to the publicinvoicetemplate setting and carefully validate any user input that could influence its value. Implement strict file access controls to prevent unauthorized file inclusion. Consider using a Web Application Firewall (WAF) with rules to detect and block attempts to manipulate log files or exploit LFI vulnerabilities. After upgrading to version 1.7.1, verify the fix by attempting to trigger the vulnerability and confirming that the system prevents code execution.