CVE-2026-33639

Name of the Vulnerable Software and Affected Versions InvoicePlane versions prior to 1.7.2

Description InvoicePlane fails to perform strict integer validation on the tax rate decimal places setting, which is controlled by the administrator. This value is interpolated into an ALTER TABLE statement for the ip tax rates table within the Settings::index() function. An attacker with administrator privileges can provide a crafted setting value to inject clauses into the schema-changing statement, allowing them to remove or alter essential database columns. This can lead to permanent corruption of financial data structures and cause the application to become unavailable.

Recommendations Update to version 1.7.2.