InvoicePlane CVE-2026-39353

Requires that the attacker already hold InvoicePlane's administrator-controlled file-write capability to place a malicious .php file into the PHP template directory that Mdl_templates scans; the planted file must then be selected as public_invoice_template. Execution is triggered when any (unauthenticated) guest renders the corresponding public invoice, at which point the guest View controller includes and runs the file with web-server privileges. Exploitation is LIMITED to versions prior to 1.7.2-rc-1 (the fix replaces directory scanning with explicit ipconfig.php allowlist constants) and is gated by the need for privileged file-write access, so it is not a fully unauthenticated attack despite the network-reachable trigger.

This is a genuine remote code execution flaw (CWE-98, PHP file inclusion), not a mislabeled lower-severity issue. The NVD CVSS of 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) is defensible: the ultimate code execution runs in the unauthenticated guest public-invoice rendering path, hence the network vector and scope change, while PR:H correctly reflects that an attacker must first possess the administrator-controlled file-write capability to plant the malicious PHP template. The real-world risk is tempered by two factors that do not appear in the raw score: (1) the high-privilege prerequisite (admin file-write) means this is not a drive-by unauthenticated RCE despite AV:N, and (2) no EPSS score, no CISA KEV listing, and no public exploit code are present in the input, so there is no evidence of active or automated exploitation. Signals are internally consistent - high CVSS impact justified by real RCE, but exploitation is gated behind privileged access, making this a serious-but-conditional issue rather than a mass-exploitation emergency. The Tags conflict with the mechanism: 'Information Disclosure' is inaccurate (this executes code, not merely leaks data) and 'LFI' only partially captures it since the included file is attacker-authored and executed.

An attacker who has obtained InvoicePlane administrator access (or otherwise abuses the admin-controlled file-write capability) drops a malicious .php file into the template directory, which Mdl_templates automatically trusts and allows to be set as the public_invoice_template. The attacker then requests a public invoice URL as an unauthenticated guest, causing the guest View controller to include and execute the planted PHP with web-server privileges. No public exploit code is identified in the provided data.