What is CVE-2026-46489?

CVE-2026-46489 is a high-severity vulnerability in Solidinvoice, classified under Cross-site Scripting. CVSS score: 8.1/10. Published 2026-06-11.

How severe is CVE-2026-46489?

High severity. CVSS v3 base score is 8.1 out of 10.

XSS in Solidinvoice

CVE-2026-46489

SolidInvoice is an open-source invoicing platform. Prior to version 2.3.17, the company logo upload feature accepts any file type without validation. An authenticated administrator can upload an SVG file containing embedded JavaScript. Thi…

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.003 (23.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N.

Affected products

Solidinvoice — versions < 2.3.17

Weakness classification (CWE)

References

security-advisories@github.com (x_refsource_MISC)
security-advisories@github.com (x_refsource_MISC)
security-advisories@github.com (x_refsource_CONFIRM)

Frequently asked questions

What is CVE-2026-46489?: CVE-2026-46489 is a high-severity vulnerability in Solidinvoice, classified under Cross-site Scripting. CVSS score: 8.1/10. Published 2026-06-11.
How severe is CVE-2026-46489?: High severity. CVSS v3 base score is 8.1 out of 10.