# CVE-2026-50547: InvoicePlane local file inclusion in invoice XML generation

Source: https://junglewise.ai/threats/cve-2026-50547-invoiceplane-is-a-self-hosted-open-source-application-for  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-25. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-50547 · Severity: high · CVSS 7.5 · Published 2026-09-25

InvoicePlane is an open-source invoicing system that manages customer financial records and payments. A low-privileged attacker who can modify e-invoice configuration settings can use path traversal techniques to read arbitrary PHP files from the server, potentially exposing sensitive data or enabling further attacks if combined with file upload capabilities. The vulnerability affects versions before 1.7.2.

Technologies: [InvoicePlane](https://junglewise.ai/threats/technologies/invoiceplane). Vendors: [InvoicePlane](https://junglewise.ai/threats/vendors/invoiceplane).

## Quick answers

**Is CVE-2026-50547 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-50547 being exploited in the wild.

**How severe is CVE-2026-50547?** High severity, with a CVSS score of 7.5, published 25 September 2026.

**Which products and versions are affected?** InvoicePlane before 1.7.2.

**Is there a fix for CVE-2026-50547?** A patch was published on 2026-05-27: Fix merged in version 1.7.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-50547 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-50547?** Check whether you run InvoicePlane at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The generate_xml() method in the Invoices controller appends an unsanitized xml_id value to a file include path without proper validation, allowing directory traversal sequences. An authenticated attacker with e-invoice configuration access can exploit this to include arbitrary PHP files via path traversal. Code execution requires an additional file-write or file-upload primitive; the LFI alone permits local file inclusion and information disclosure.

## Affected products

- InvoicePlane InvoicePlane before 1.7.2

## Timeline

- 2026-09-25: disclosed
- 2026-05-27: patched: Fix merged in version 1.7.2

## References

- [https://github.com/InvoicePlane/InvoicePlane/commit/07ebd6b5922b47b941cc3c6922c39043ad558d8f](https://github.com/InvoicePlane/InvoicePlane/commit/07ebd6b5922b47b941cc3c6922c39043ad558d8f)
- [https://github.com/InvoicePlane/InvoicePlane/pull/1560](https://github.com/InvoicePlane/InvoicePlane/pull/1560)

## Related threats

- [InvoicePlane authorization bypass in guest quote operations](https://junglewise.ai/threats/cve-2026-55561-invoiceplane-is-a-self-hosted-open-source-application-for)
- [InvoicePlane missing object-level authorization in Users::form()](https://junglewise.ai/threats/cve-2026-100392-invoiceplane-is-a-self-hosted-open-source-application-for)
- [InvoicePlane authorization bypass in Users::form()](https://junglewise.ai/threats/cve-2026-100371-invoiceplane-is-a-self-hosted-open-source-application-for)
- [InvoicePlane privilege escalation via stale session validation](https://junglewise.ai/threats/cve-2026-88003-invoiceplane-is-a-self-hosted-open-source-application-for)
- [InvoicePlane stored XSS in client email field](https://junglewise.ai/threats/cve-2026-85293-invoiceplane-is-a-self-hosted-open-source-application-for)