CyberRota Analysis
AI-GeneratedInvoicePlane versions prior to 1.7.2 are vulnerable to local file inclusion due to insufficient validation in the Invoices::generate_xml() method, allowing low-privileged attackers to manipulate e-invoice configurations. This vulnerability can lead to the inclusion of arbitrary PHP files, potentially resulting in code execution if combined with other file upload or write vulnerabilities. Organizations using affected versions should prioritize upgrading to 1.7.2 to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane's Invoices::generate_xml() method appends a database-derived xml_id to the XMLconfigs helper directory and includes the resulting PHP path without validating the identifier. A low-privileged attacker who can influence the e-invoice configuration can use traversal sequences to include an existing PHP file. The standalone advisory establishes local file inclusion; code execution requires a separate file-upload or file-write primitive. This issue is fixed in version 1.7.2.