CVE-2026-39372 InvoicePlane: Sensitive Information Disclosure via Unstripped EXIF Metadata in Attachments
Attackers can retrieve sensitive EXIF metadata like GPS coordinates from uploaded image attachments, exposing private user location and device details.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-39372?
CVE-2026-39372 is a medium-severity vulnerability in InvoicePlane, published on 25 Sep 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane stores and serves uploaded image attachments without stripping EXIF metadata. When an administrator uploads an image through invoice attachments, quote attachments, or another attachment feature and shares it with another user, the recipient can retrieve embedded GPS coordinates, timestamps, and device information. The preserved metadata can disclose private location and device details across users. This vulnerability is fixed in 1.7.2.
Which versions are affected by CVE-2026-39372?
How do I fix CVE-2026-39372?
No fix has been published for CVE-2026-39372 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-39372 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-39372 exists.
Sources
Also known as GHSA-7j67-2v6p-275v.