CVE-2025-10009

Published: Sep 22, 2025

Modified: Sep 22, 2025

PUBLISHED

Description

Incorrect handling of uploaded files in the admin "Restore" function in Invoice Ninja <= 5.11.72 allows attackers with admin credentials to execute arbitrary code on the server via uploaded .php files.

Vendor	Product	Versions
Invoice Ninja	Invoice Ninja 5	affected `5.11.41 - <= 5.11.72` unaffected `5.11.73 - <= *`

Weaknesses (CWE)

CWE-434

References

https://github.com/invoiceninja/invoiceninja/commit/02151b570b226b4584a8e61b06b10be9366da3de

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now

CVE-2025-10009

Description

Affected Products

Weaknesses (CWE)

References