Log in Start free

Vulnerability · Published Sep 25, 2026 · Assigned by GitHub_M

CVE-2026-39372InvoicePlane: Sensitive Information Disclosure via Unstripped EXIF Metadata in Attachments

Medium 4.9

In plain English

A medium-severity information exposure in InvoicePlane from InvoicePlane. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities).

Severity (CVSS 3.1)4.9Medium
Exploit odds (30 days)0.4%top 70.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane stores and serves uploaded image attachments without stripping EXIF metadata. When an administrator uploads an image through invoice attachments, quote attachments, or another attachment feature and shares it with another user, the recipient can retrieve embedded GPS coordinates, timestamps, and device information. The preserved metadata can disclose private location and device details across users. This vulnerability is fixed in 1.7.2.

Affected products (as reported)

VendorProductVersions
InvoicePlane InvoicePlane < 1.7.2

Weakness: CWE-359, CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

References