CVE-2026-39372

Name of the Vulnerable Software and Affected Versions InvoicePlane versions prior to 1.7.2

Description InvoicePlane stores and serves uploaded image attachments without stripping EXIF metadata (Exchangeable Image File Format, a standard for storing metadata in image files). When an administrator uploads an image through invoice attachments, quote attachments, or other attachment features and shares it with another user, the recipient can retrieve embedded GPS coordinates, timestamps, and device information, potentially disclosing private location and device details.

Recommendations Update to version 1.7.2.