InvoicePlane 1.7.0 suffered a remote code execution flaw that combines a local file inclusion weakness with log poisoning. An authenticated administrator can change the public_invoice_template setting to point to a log file that contains injected PHP code, enabling the execution of arbitrary system commands on the host. The vulnerabilities align with CWE‑117, CWE‑94, and CWE‑98 and allow the attacker to fully compromise confidentiality, integrity, and availability of the server.

The affected product is InvoicePlane’s web application, specifically the 1.7.0 release. All instances running this version without the 1.7.1 patch are susceptible.

The CVSS score of 9.1 marks the flaw as critical, but the EPSS score of less than 1% indicates a low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog, suggesting no known exploitation in the wild. The attack requires authenticated administrative privileges and leverages the configuration setting for public invoices, providing a clear vector for exploitation. Impact assessment therefore remains high due to the severe damage that could result if the flaw is leveraged by insiders or compromised administrators.