CVE-2025-67082: 
NixOS vulnerability analysis and mitigation

CVE-2025-67082 is an SQL injection vulnerability in InvoicePlane, a self-hosted open-source invoicing application, affecting all versions through 1.6.3. The flaw exists in the maxQuantity and minQuantity parameters used during report generation, where insufficient sanitization of single quotes allows authenticated attackers to perform error-based SQL injection and extract arbitrary data from the database. The CVE was published on January 15, 2026, with initial analysis completed by January 22, 2026. It carries a CVSS v3.1 base score of 6.5 (Medium), assessed by CISA-ADP (Red Hat CVE, Helx Advisory).

The vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) and stems from the application's failure to properly sanitize single-quote characters in user-supplied input before incorporating them into SQL queries (Red Hat CVE). An authenticated attacker can manipulate the maxQuantity or minQuantity parameters in the report generation functionality to inject malicious SQL, triggering error-based responses that leak database contents. The attack vector is network-based, requires low privileges (a valid authenticated session), and no user interaction, making it straightforward to exploit once credentials are obtained (Helx Advisory).

Successful exploitation allows an authenticated attacker to extract arbitrary data from the underlying database, potentially exposing sensitive business information including customer records, financial data, invoice details, and application credentials. The impact is limited to confidentiality — integrity and availability are not directly affected by this vulnerability. Organizations running InvoicePlane as a multi-tenant or internet-facing service face the greatest risk, as compromised data could enable further attacks or regulatory violations (Red Hat CVE, Helx Advisory).

A proof-of-concept exploit is publicly available via the Helx security advisory, which was added as a reference in the NVD entry on January 22, 2026 (Helx Advisory). There is no current evidence of active in-the-wild exploitation or threat actor attribution. The EPSS score is approximately 0.026% (0.000260), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Authenticate: Obtain valid credentials for an InvoicePlane instance running version 1.6.3 or earlier — low-privilege user accounts are sufficient.
2. Navigate to report generation: Access the report generation feature within the InvoicePlane web interface, which accepts maxQuantity and minQuantity as input parameters.
3. Inject SQL payload: Modify the maxQuantity or minQuantity parameter to include a crafted SQL injection payload exploiting insufficient single-quote sanitization (e.g., 1' AND EXTRACTVALUE(1,CONCAT(0x7e,(SELECT version())))-- -) to trigger an error-based response.
4. Extract data: Analyze the database error messages returned in the application response to enumerate database structure, tables, and extract sensitive data such as user credentials, client records, and financial information.
5. Iterate: Repeat with refined payloads to extract additional data from other tables in the database (Helx Advisory).

• Network: Unusual HTTP requests to InvoicePlane report generation endpoints containing SQL metacharacters (single quotes, SQL keywords like SELECT, UNION, EXTRACTVALUE, CONCAT) in maxQuantity or minQuantity parameters.
• Logs: Web server access logs showing repeated requests to report generation URLs with anomalous parameter values; application error logs containing SQL error messages or stack traces triggered by malformed queries.
• Application: Database query logs showing unexpected SQL syntax errors or queries containing injection patterns originating from the report generation module.

Upgrade InvoicePlane to version 1.6.4 or later, which addresses this vulnerability (Helx Advisory, InvoicePlane GitHub). As interim mitigations, restrict access to the report generation functionality to trusted users only, and deploy a Web Application Firewall (WAF) configured to detect and block SQL injection patterns targeting the affected parameters. Monitor database query logs for suspicious SQL activity and ensure the principle of least privilege is applied to the database account used by InvoicePlane.