CVE-2026-85290 Details
Description
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane's Cron::recur() method writes an invalid cron key from the URL path directly to the application log without neutralizing CRLF characters. An unauthenticated requester can place forged log lines into the audit trail by supplying a crafted cron_key value. The injected entries can corrupt forensic records and interfere with log-based monitoring. This issue is fixed in version 1.7.2.
A log injection vulnerability has been identified in InvoicePlane versions prior to 1.7.2. The issue arises in the Cron::recur() method, where user-supplied cron key values are logged directly without proper sanitization, allowing the insertion of forged log entries. This unsanitized input can corrupt audit trails and disrupt log-based monitoring. The vulnerability can be exploited by sending a crafted cron_key value via the URL, injecting arbitrary content that includes CRLF characters into the application log.
Users can upgrade to InvoicePlane version 1.7.2 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 25, 2026CISA-ADP
Assessed Sep 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/InvoicePlane/InvoicePlane/security/advisories/GHSA-g53q-v2pv-xr83 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/InvoicePlane/InvoicePlane/commit/97fd1b6a0426b132abea16ef767625fb357adb38 | [email protected] | Source CodeVendor |
| https://github.com/InvoicePlane/InvoicePlane/pull/1639 | [email protected] | Issue TrackingVendor |
| https://github.com/InvoicePlane/InvoicePlane/releases/tag/v1.7.2 | [email protected] | Release NotesVendor |
| https://github.com/InvoicePlane/InvoicePlane/security/advisories/GHSA-g53q-v2pv-xr83 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-117 | Improper Output Neutralization for Logs | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| InvoicePlane | <= 1.7.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 29, 2026 | CVE Modified | CISA-ADP |
| Sep 25, 2026 | New CVE Received | [email protected] |