Quick answers
- Is CVE-2026-54790 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-54790 being exploited in the wild.
- How severe is CVE-2026-54790?
- Medium severity, with a CVSS score of 6, published 25 September 2026.
- Which products and versions are affected?
- InvoicePlane before 1.7.2.
- Is there a fix for CVE-2026-54790?
- A patch was published on 2026-06-09: Fix merged in PR #1573 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-54790 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-54790?
- Check whether you run InvoicePlane at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A second-order SQL injection exists in the custom_field_table parameter, which is stored without validation and later concatenated unescaped into FROM and WHERE clauses in Mdl_custom_fields::used(), Mdl_custom_fields::delete(), and Mdl_custom_values::used(). An authenticated administrator can inject SQL via the custom field edit form to execute arbitrary queries against the application database. CodeIgniter does not parameterize identifier positions, allowing the attack vector. The fix adds input validation and defense-in-depth checks using an allow-list of valid table names.
Affected products
- InvoicePlane InvoicePlane before 1.7.2
Timeline
- 2026-09-25: disclosed
- 2026-06-09: patched: Fix merged in PR #1573