XSS in Invoiceplane
CVE-2026-24743
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting (XSS) vulnerability occurs in the upload Invoice Logo functions of InvoicePlane version 1.7.0. The Upload Invoice Logo function allows the application to upload svg files. Although administrator privileges are required to exploit it, this is still considered a critical vulnerability as it can cause actions such as unauthorized modification of application data, creation of persistent backdoors through stored malicious scripts, and full compromise of the application's integrity. Version 1.7.1 patches the issue.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.002 (12.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.7 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:H/A:L.
Affected products
- Invoiceplane — versions 1.7.0, = 1.7.0
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Exploit, Mitigation, Vendor Advisory)
- security-advisories@github.com (Patch, x_refsource_MISC)
Frequently asked questions
- What is CVE-2026-24743?
- CVE-2026-24743 is a medium-severity vulnerability in Invoiceplane, classified under Cross-site Scripting. CVSS score: 5.7/10. Published 2026-02-18.
- How severe is CVE-2026-24743?
- Medium severity. CVSS v3 base score is 5.7 out of 10.