{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-06-16T22:52:43.924","vulnerabilities":[{"cve":{"id":"CVE-2026-25548","sourceIdentifier":"security-advisories@github.com","published":"2026-02-18T23:16:19.567","lastModified":"2026-02-20T18:45:32.913","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A critical Remote Code Execution (RCE) vulnerability exists in InvoicePlane 1.7.0 through a chained Local File Inclusion (LFI) and Log Poisoning attack. An authenticated administrator can execute arbitrary system commands on the server by manipulating the `public_invoice_template` setting to include poisoned log files containing PHP code. Version 1.7.1 patches the issue."},{"lang":"es","value":"InvoicePlane es una aplicación de código abierto autoalojada para gestionar facturas, clientes y pagos. Una vulnerabilidad crítica de ejecución remota de código (RCE) existe en InvoicePlane 1.7.0 a través de un ataque encadenado de inclusión local de ficheros (LFI) y envenenamiento de logs. Un administrador autenticado puede ejecutar comandos de sistema arbitrarios en el servidor manipulando la configuración 'public_invoice_template' para incluir ficheros de log envenenados que contienen código PHP. La versión 1.7.1 corrige el problema."}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.3,"impactScore":6.0}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-94"},{"lang":"en","value":"CWE-98"},{"lang":"en","value":"CWE-117"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:invoiceplane:invoiceplane:*:*:*:*:*:*:*:*","versionEndExcluding":"1.7.1","matchCriteriaId":"200F4F45-C04E-4F4E-9DF4-CE8D5ABEDB9F"}]}]}],"references":[{"url":"https://github.com/InvoicePlane/InvoicePlane/commit/93622f2df88a860d89bfee56012cabb2942061d6","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/InvoicePlane/InvoicePlane/security/advisories/GHSA-g6rw-m9mf-33ch","source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory"]}]}}]}