CVE-2026-39372CWE-200CWE-359information-disclosure

CVE-2026-39372

Medium · published September 25, 2026

CVSS v3.1
4.9
EPSS
0%
Percentile
19.2
In the wild
Unconfirmed
What it is

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane stores and serves uploaded image attachments without stripping EXIF metadata. When an administrator uploads an image through invoice attachments, quote attachments, or another attachment feature and shares it with another user, the recipient can retrieve embedded GPS coordinates, timestamps, and device information. The preserved metadata can disclose private location and device details across users. This vulnerability is fixed in 1.7.2.

The record
Technical detail
CVSS v3.1
4.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00278 · 19.2th percentile
Weaknesses
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor; CWE-359 · Exposure of Private Personal Information to an Unauthorized Actor
Published
2026-09-25T20:17Z
References (5)
https://github.com/InvoicePlane/InvoicePlane/commit/90381b49d9ff3a817cf25d12d7dc118eb070aa3a · [email protected]https://github.com/InvoicePlane/InvoicePlane/pull/1507 · [email protected]https://github.com/InvoicePlane/InvoicePlane/releases/tag/v1.7.2 · [email protected]https://github.com/InvoicePlane/InvoicePlane/security/advisories/GHSA-7j67-2v6p-275v · [email protected]https://github.com/InvoicePlane/InvoicePlane/security/advisories/GHSA-7j67-2v6p-275v · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 27 SEP 03:26Z
    EPSS moved — → 0%
    epss
  • 25 SEP 15:21Z
    InvoicePlane: Sensitive Information Disclosure via Unstripped EXIF Metadata in Attachments
    cvelistv5