InvoicePlane’s generate_xml() function concatenates a database‑derived identifier into a path within the XMLconfigs helper directory without validating the identifier. This flaw, classified as CWE‑22 path traversal and CWE‑98 incorrect selection, permits a low‑privileged attacker who can influence the e‑invoice configuration to craft traversal sequences and include any existing PHP file on the server. The vulnerability allows local file inclusion; achieving code execution would require an additional file‑upload or file‑write exploitation, so the immediate impact is unauthorized disclosure of server files and a potential vector to execute pre‑existing PHP payloads.

The issue affects the InvoicePlane invoicing application in all releases prior to v1.7.2. Users running 1.7.1 or earlier are vulnerable; the problem was fixed in v1.7.2.

The CVSS score of 7.5 indicates high severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no widespread exploitation to date. The likely attack vector requires an attacker to be able to modify the e‑invoice configuration, typically a low‑privileged user role. If such privileges are attainable, the attacker could include arbitrary server files; remote code execution would still depend on the presence of another weakness such as a file‑upload or file‑write capability.