An authenticated administrator can execute arbitrary code on the underlying web server through a template injection flaw in InvoicePlane versions prior to 1.7.2-rc-1.

This vulnerability involves improper control of filenames for include statements (CWE-98) and incorrect permission assignments. It allows an attacker with administrator privileges to place arbitrary PHP code into a directory that the application automatically trusts and executes when rendering public invoices.

The ability to execute arbitrary code with web server privileges represents a critical security risk, as it allows for full system compromise, data exfiltration, and lateral movement within the network. With a CVSS score of 9.1, this flaw poses a severe threat to the confidentiality, integrity, and availability of the hosting environment. Organizations relying on InvoicePlane for financial management face significant operational and reputational risks if this vulnerability is exploited to manipulate invoice data or gain unauthorized access to sensitive client information.

Immediate Action: Upgrade the InvoicePlane installation to version 1.7.2-rc-1 or later immediately to resolve the directory trust issue.

Proactive Monitoring: Monitor server access logs for unusual file creation activity in the template directory and inspect the integrity of PHP files located within the application path.

Compensating Controls: Implement strict file system permissions to restrict write access to the template directory and utilize a Web Application Firewall to block suspicious file upload requests.

Public Exploit Available: No (exploit_available: unknown)

Given the critical severity of this vulnerability, administrators should prioritize the update to version 1.7.2-rc-1 to eliminate the underlying code execution vector. Failure to patch this issue leaves the application vulnerable to complete system takeover, and manual review of the template directory for unauthorized or suspicious files is strongly recommended until the patch is verified.