CVE-2026-33639 InvoicePlane permits DDL injection through tax_rate_decimal_places
An administrator can inject SQL into the tax rate setting to corrupt database schemas, causing data loss and application unavailability.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-33639?
CVE-2026-33639 is a high-severity SQL injection vulnerability in InvoicePlane, published on 25 Sep 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane interpolates the administrator-controlled tax_rate_decimal_places setting into an ALTER TABLE statement for ip_tax_rates in Settings::index() without strict integer validation. A crafted setting value can add clauses to the schema-changing statement and remove or alter required database columns. The resulting schema corruption can permanently modify financial data structures and make the application unavailable. This vulnerability is fixed in 1.7.2.
Weakness: CWE-89
Which versions are affected by CVE-2026-33639?
How do I fix CVE-2026-33639?
No fix has been published for CVE-2026-33639 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2026-33639 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-33639 exists.
Sources
Also known as GHSA-34g5-4hfc-g983.