CVE-2026-50547

Name of the Vulnerable Software and Affected Versions InvoicePlane versions prior to 1.7.2

Description The Invoices::generate xml() function appends a database-derived xml id to the XMLconfigs helper directory and includes the resulting PHP path without proper validation of the identifier. A low-privileged attacker capable of influencing the e-invoice configuration can utilize traversal sequences to perform local file inclusion, which allows the inclusion of existing PHP files. Achieving remote code execution would require an additional file-upload or file-write primitive.

Recommendations Update to version 1.7.2.