InvoicePlane versions prior to 1.7.2-rc-1 allow an attacker who can place a PHP file in the template directory to have that file automatically marked as a trusted template. When a public invoice is rendered, the view controller includes and executes the file with web‑server privileges, giving the attacker remote code execution on the host. The weakness is a combination of improper input validation (CWE‑693), insecure file permissions (CWE‑732), and insecure directory traversal handling (CWE‑98).

Any self‑hosted InvoicePlane installation running a version earlier than 1.7.2-rc-1 is affected. The vulnerability exists in the default configuration where the PHP template directory is writable by a user with administrative file‑write capabilities.

With a CVSS score of 9.1 the vulnerability represents a critical risk. EPSS is not reported, and the issue is not listed in the CISA KEV catalog. The only prerequisite is the ability to write files to the PHP template directory, which typically requires administrative privileges or a compromised admin account. Once an attacker achieves this, they can execute arbitrary code during invoice rendering without any additional steps.