CVE-2026-39372

MediumCVSS 4.9/10Last modified Sep 29, 2026

Description

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane stores and serves uploaded image attachments without stripping EXIF metadata. When an administrator uploads an image through invoice attachments, quote attachments, or another attachment feature and shares it with another user, the recipient can retrieve embedded GPS coordinates, timestamps, and device information. The preserved metadata can disclose private location and device details across users. This vulnerability is fixed in 1.7.2.

Metrics

CVSS 3.1 4.9/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200 CWE-359

Affected software

No affected versions have been published.

Timeline

Published: Sep 25, 2026
Last modified: Sep 29, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-393735.3JWCrypto implements JWK, JWS, and JWE specifications using python-cryptography. Prior to 1.5.7, an unauthenticated attacker can exhaust serv CVE-2026-393747.7Plane is an an open-source project management tool. Prior to 1.3.0, the IssueBulkUpdateDateEndpoint allows a project member (ADMIN or MEMBER CVE-2026-393767.5FastFeedParser is a high performance RSS, Atom and RDF parser. Prior to 0.5.10, when parse() fetches a URL that returns an HTML page contain CVE-2026-393776.5The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. Versions 6.5 through 7.17.0 CVE-2026-393786.5The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. In versions 6.5 through 7.17 CVE-2026-39384.3Insufficient policy enforcement in Clipboard in Google Chrome prior to 146.0.7680.71 allowed a remote attacker who had compromised the rende CVE-2026-393805.4Open Source Point of Sale is a web based point-of-sale application written in PHP using CodeIgniter framework. Prior to 3.4.3, a Stored Cros CVE-2026-393814.3Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.8.0-alpha.7 and 8.6.75, t CVE-2026-393829.3dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. CVE-2026-393837.2Gotenberg is an API-based document conversion tool. In version 8.29.1, an unauthenticated attacker with network access can force the server CVE-2026-393847.6FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to 1.8.212, FreeScout does not take the limit_user_CVE-2026-393857.1Frappe LMS is an open source learning management system. In version 2.51.0 and earlier, a user could bypass payment validation for courses b