All vulnerabilities
CVE-2026-54790GHSA-vv4r-cgmw-w6x2

InvoicePlane: Second-order SQL injection through the unvalidated custom_field_table field in the Custom Fields module

InvoicePlane InvoicePlane
Open in ThreatlineRecord JSON
CVSS
6.0Medium
ExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 28 Sep 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.23%Chance of exploitation activity in the next 30 days, higher than 13% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in1.7.2Fixed versionGitHub
Published25 Sep 2026Updated 28 Sep 2026CVE List

What fixes it

  • 1.7.2InvoicePlane/InvoicePlaneGitHub

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane stores an administrator-controlled custom_field_table value without validating it against the allowed custom-field table names. Mdl_custom_fields::used() later concatenates that stored value into the FROM table and WHERE column identifier positions, so opening the custom-field edit form executes a second-order SQL injection. The injection can query arbitrary schema data and can cause application errors or denial of service. This issue is fixed in version 1.7.2.

Text from CVE List

Affected versions 2

  • InvoicePlaneaffected: < 1.7.2CVE List
  • InvoicePlane/InvoicePlane<= 1.7.1GitHub

References 4