CVE-2025-10009 — Authenticated admin RCE in Invoice Ninja
Incorrect handling of uploaded files in the admin "Restore" function in Invoice Ninja <= 5.11.72 allows attackers with admin credentials to execute arbitrary code on the server …
Published: 2025-09-22 · CVSS: 8.6 · CVSS 4.0
Incorrect handling of uploaded files in the admin "Restore" function in Invoice Ninja <= 5.11.72 allows attackers with admin credentials to execute arbitrary code on the server via uploaded .php files.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7