InvoicePlane was storing uploaded image attachments without removing EXIF metadata. The preserved data includes GPS coordinates, timestamps, and device information that can be extracted by any user who receives the attachment. This disclosure can reveal private location and device details, compromising user privacy. The weakness is a classic information disclosure flaw under CWE-200 and the presence of untrusted metadata is a candidate for CWE-359.

The vulnerability affects all versions of InvoicePlane prior to 1.7.2. Any installation that allows an administrator to upload image attachments to invoices, quotes, or other attachment features is potentially vulnerable.

The risk rating is moderate with a CVSS score of 4.9, and no EPSS data is available. The vulnerability is not listed in the CISA KEV catalog. The likely attack path is internal: an administrator uploads an image that retains metadata; a recipient who receives the attachment can then read the embedded information. No public exploitation code has been reported, and the exploit requires privileged access to the upload feature.