InvoicePlane CVE-2026-85290

No special conditions - remote unauthenticated exploitation against default configurations of InvoicePlane prior to 1.7.2. The attacker only needs network access to the Cron::recur() endpoint and supplies a crafted cron_key with CRLF characters in the URL path; because the key is validated as 'wrong' and logged, no valid credentials or configuration changes are required. The practical LIMIT is impact, not access: the flaw only allows forging/polluting log entries (Integrity of the audit trail), so it yields no data disclosure, code execution, or denial of service, and its value to an attacker depends on log-based monitoring or forensics being in use.

This is a genuinely low-severity issue whose CVSS of 5.3 accurately reflects limited impact. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) shows a network-reachable, low-complexity, unauthenticated flaw, but with only limited Integrity impact (C:N/A:N) - consistent with CWE-117 log injection, which corrupts log records rather than compromising the running system. No EPSS score, no CISA KEV listing, and no public exploit code were provided, so exploitation status is: no public exploit identified at time of analysis. The 'unauthenticated + network + low complexity' profile makes the flaw trivially triggerable, but the ceiling is forged/garbled audit-log lines, not data theft, code execution, or service disruption. Real-world priority is low: it is a forensic-integrity and monitoring-evasion concern (e.g., an attacker hiding other activity by polluting logs), most relevant as a defense-in-depth fix rather than an urgent patch. No signals conflict - the CVSS impact metrics, the description, and the CWE all agree this is log injection, not code injection despite the 'Code Injection' tag.

An unauthenticated attacker sends a crafted HTTP request to the InvoicePlane cron endpoint with a cron_key value containing embedded CRLF sequences and forged text. Because Cron::recur() writes the invalid key straight to the application log without neutralizing newlines, the attacker injects fabricated log entries that can mask real activity or mislead responders during incident analysis. No public exploit code is identified, but the attack is trivial to reproduce given the low complexity and lack of authentication.