Description
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane's Invoices::generate_xml() method appends a database-derived xml_id to the XMLconfigs helper directory and includes the resulting PHP path without validating the identifier. A low-privileged attacker who can influence the e-invoice configuration can use traversal sequences to include an existing PHP file. The standalone advisory establishes local file inclusion; code execution requires a separate file-upload or file-write primitive. This issue is fixed in version 1.7.2.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
InvoicePlane InvoicePlane
< 1.7.2affected
References
- https://github.com/InvoicePlane/InvoicePlane/security/advisories/GHSA-9248-qccw-7x7j ↗
- https://github.com/InvoicePlane/InvoicePlane/pull/1560 ↗
- https://github.com/InvoicePlane/InvoicePlane/commit/07ebd6b5922b47b941cc3c6922c39043ad558d8f ↗
- https://github.com/InvoicePlane/InvoicePlane/releases/tag/v1.7.2 ↗