# CVE-2026-39353: InvoicePlane arbitrary code execution in template inclusion

Source: https://junglewise.ai/threats/cve-2026-39353-invoiceplane-is-a-self-hosted-open-source-application-for  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-25. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-39353 · Severity: critical · CVSS 9.1 · Published 2026-09-25

InvoicePlane is a self-hosted invoicing application that manages clients, invoices, and payments. An administrator-controlled file-write capability allows malicious PHP code to be placed in the template directory, which is then automatically trusted and executed as web-server code when rendering public invoices. This grants an attacker the ability to execute arbitrary PHP code on the server.

Technologies: [InvoicePlane](https://junglewise.ai/threats/technologies/invoiceplane). Vendors: [InvoicePlane](https://junglewise.ai/threats/vendors/invoiceplane).

## Quick answers

**Is CVE-2026-39353 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-39353 being exploited in the wild.

**How severe is CVE-2026-39353?** Critical severity, with a CVSS score of 9.1, published 25 September 2026.

**Which products and versions are affected?** InvoicePlane before 1.7.2-rc-1.

**Is there a fix for CVE-2026-39353?** A patch was published on 2026-04-25: Fix merged in version 1.7.2-rc-1 replacing directory_map() scanning with explicit config allowlisting Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-39353 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-39353?** Check whether you run InvoicePlane at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in Mdl_templates.php, which scans a writable template directory and automatically trusts all PHP files found in it for use as public invoice templates. An attacker with admin file-write access can place a malicious PHP file in the template directory; when a guest requests a public invoice, the View controller includes and executes the attacker's file with web-server privileges. The fix (v1.7.2-rc-1) replaces directory scanning with explicit configuration allowlisting.

## Affected products

- InvoicePlane InvoicePlane before 1.7.2-rc-1

## Timeline

- 2026-04-25: patched: Fix merged in version 1.7.2-rc-1 replacing directory_map() scanning with explicit config allowlisting
- 2026-09-25: disclosed

## References

- [https://github.com/InvoicePlane/InvoicePlane/commit/00e599db25804024eb323cfb751349bf3b1d8e8a](https://github.com/InvoicePlane/InvoicePlane/commit/00e599db25804024eb323cfb751349bf3b1d8e8a)
- [https://github.com/InvoicePlane/InvoicePlane/pull/1536](https://github.com/InvoicePlane/InvoicePlane/pull/1536)

## Related threats

- [InvoicePlane authorization bypass in guest quote operations](https://junglewise.ai/threats/cve-2026-55561-invoiceplane-is-a-self-hosted-open-source-application-for)
- [InvoicePlane missing object-level authorization in Users::form()](https://junglewise.ai/threats/cve-2026-100392-invoiceplane-is-a-self-hosted-open-source-application-for)
- [InvoicePlane authorization bypass in Users::form()](https://junglewise.ai/threats/cve-2026-100371-invoiceplane-is-a-self-hosted-open-source-application-for)
- [InvoicePlane privilege escalation via stale session validation](https://junglewise.ai/threats/cve-2026-88003-invoiceplane-is-a-self-hosted-open-source-application-for)
- [InvoicePlane stored XSS in client email field](https://junglewise.ai/threats/cve-2026-85293-invoiceplane-is-a-self-hosted-open-source-application-for)