Skip to content
CVE PROGRAM SOURCE RECORD8.6 High

CVE-2025-10009

Authenticated admin RCE in Invoice Ninja

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
NCSC-FI

Description

Incorrect handling of uploaded files in the admin "Restore" function in Invoice Ninja <= 5.11.72 allows attackers with admin credentials to execute arbitrary code on the server via uploaded .php files.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Invoice Ninja Invoice Ninja 5

Default version status: unaffected

  • 5.11.41 to ≤ 5.11.72affected
  • 5.11.73 to ≤ *unaffected

References