Technical impact
The vulnerability allows an unauthenticated user to embed arbitrary CRLF sequences into the cron_key URL parameter, which the Cron::recur() method logs without sanitization. The injected log entries appear as legitimate audit records, potentially masking malicious activity or corrupting forensic investigations. This type of log injection falls under CWE‑117, compromising the integrity of audit trails.
Affected Systems
InvoicePlane versions older than 1.7.2 are affected. The issue was resolved in the 1.7.2 release. Administrators using any self‑hosted instance of InvoicePlane before that version are susceptible unless mitigated.
Risk and Exploitability
The CVSS score of 5.3 indicates a moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. An attacker requires no authentication, leveraging the public cron endpoint to supply a crafted cron_key. The exploit is straightforward if the endpoint is reachable and the instance logs errors. Given the lack of high exploitation probability data, the risk remains moderate, but the potential for log tampering warrants urgency in remediation.
