What is CVE-2026-46489?

CVE-2026-46489 is a high-severity vulnerability in Solidinvoice, classified under Cross-site Scripting. CVSS score: 8.1/10. Published 2026-06-11.

How severe is CVE-2026-46489?

High severity. CVSS v3 base score is 8.1 out of 10.

XSS in Solidinvoice

CVE-2026-46489

SolidInvoice is an open-source invoicing platform. Prior to version 2.3.17, the company logo upload feature accepts any file type without validation. An authenticated administrator can upload an SVG file containing embedded JavaScript. This script is base64-encoded and injected unescaped into every page of the application, causing stored cross-site scripting (XSS) that executes in every authenticated user's browser. This issue has been patched in version 2.3.17.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.003 (23.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N.

Affected products

Solidinvoice — versions < 2.3.17

Weakness classification (CWE)

References

security-advisories@github.com (x_refsource_MISC)
security-advisories@github.com (x_refsource_MISC)
security-advisories@github.com (x_refsource_CONFIRM)

Frequently asked questions

What is CVE-2026-46489?: CVE-2026-46489 is a high-severity vulnerability in Solidinvoice, classified under Cross-site Scripting. CVSS score: 8.1/10. Published 2026-06-11.
How severe is CVE-2026-46489?: High severity. CVSS v3 base score is 8.1 out of 10.