InvoicePlane CVE-2026-39372

Requires that an administrator (or other uploader) actually uploads an image containing EXIF metadata - GPS coordinates, timestamps, or device info - through the invoice attachment, quote attachment, or another attachment feature, AND that the image is shared with a separate recipient user who is authenticated to view it. Exploitation is limited to whatever sensitive metadata happens to be embedded in the uploaded files; images without EXIF (e.g., screenshots, scanned PDFs) expose nothing. Critically, even after upgrading to 1.7.2 the protection remains INEFFECTIVE unless the operator manually enables SEC_STRIP_EXIF_FROM_IMAGES in ipconfig.php, since the mitigation ships disabled by default.

This is a low-priority, high-conditionality privacy disclosure, not an exploitable code-execution or takeover flaw. All signals point the same direction: NVD CVSS is only 4.9 (Medium), there is no EPSS score provided, no CISA KEV listing, and no public POC - matching the 'no public exploit identified' status. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N is internally consistent with an info-only leak (I:N/A:N) but the C:H rating is arguably overstated: the leaked data is EXIF metadata (GPS, timestamps, device model) embedded in images an administrator chose to upload, not credentials, database contents, or full-file disclosure - a C:L rating better reflects the limited, indirect nature of the exposure. Notably the vendor's own fix ships EXIF stripping DISABLED BY DEFAULT (SEC_STRIP_EXIF_FROM_IMAGES=false in ipconfig.php), meaning even patched 1.7.2 installs remain vulnerable unless an operator explicitly enables the setting - a significant caveat security teams must know. The 'Information Disclosure' tag is accurate here (genuine CWE-359), unlike many mislabeled entries. Net: real but minor, targeted rather than mass-exploitable.

An administrator uploads a smartphone photo (e.g., a receipt, site photo, or client document containing EXIF GPS and device data) as an invoice or quote attachment and shares it with another InvoicePlane user. That recipient downloads the served image and reads the intact EXIF block, learning the admin's physical location coordinates, capture timestamps, and camera/device model. No public exploit code exists; extraction requires only a standard EXIF reader.