InvoicePlane EUVD-2026-87132

Requires an authenticated low-privileged InvoicePlane account (prior to version 1.7.2) that can influence the e-invoice configuration where the xml_id value is stored. The attacker must supply a traversal sequence in xml_id and target an EXISTING .php file reachable from the XMLconfigs helper directory, since Invoices::generate_xml() calls file_exists() before include(). Exploitation is LIMITED by: the need for valid credentials with config-write access, the requirement that the traversal resolve to an already-present PHP file, and the fact that full remote code execution is NOT achievable through this flaw alone - it depends on a separate file-upload/file-write capability. Fixed in 1.7.2 via an alphanumeric-plus-hyphen allowlist on xml_id.

This is a moderate-priority, not urgent, finding. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H = 7.5) combines network reachability with two dampeners: AC:H (attacker must be able to influence the e-invoice configuration AND supply a traversal path resolving to an existing includable PHP file) and PR:L (a valid low-privileged authenticated account is required - this is not an anonymous internet attack). No EPSS score, no CISA KEV listing, and no public exploit code are present in the provided data, so exploitation status is 'no public exploit identified at time of analysis.' The I:H/A:H components of the NVD vector appear overstated: the vendor advisory (GHSA-9248-qccw-7x7j) explicitly states the standalone bug is local file inclusion and that code execution requires a SEPARATE file-upload or file-write primitive - so integrity/availability impact is conditional on a second, unlisted weakness rather than intrinsic to this CVE. The 'RCE' tag is therefore misleading relative to the advisory's own scoping. Net: a real authenticated LFI worth patching, but its practical severity is closer to a high-confidentiality information-disclosure issue than a directly weaponizable remote-code-execution flaw.

An attacker holding a low-privileged InvoicePlane account with access to the e-invoice/XML configuration sets the stored xml_id to a traversal sequence (e.g. '../../../some/existing') so that Invoices::generate_xml() includes an arbitrary existing PHP file outside the XMLconfigs helper directory. This yields local file inclusion of application source or configuration; to escalate to code execution the attacker must independently plant or overwrite a PHP file via a separate primitive. No public exploit code is identified in the available data.