Stored Cross-Site Scripting Vulnerability in InvoicePlane Application

CVE-2026-24745

What is CVE-2026-24745?

InvoicePlane is a self-hosted, open-source application designed for managing invoices, clients, and payments. It is affected by a Stored Cross-Site Scripting (XSS) vulnerability specifically in its Upload Login Logo function. This vulnerability allows unauthorized users, provided they possess administrator privileges, to upload SVG files. The exploit could lead to unauthorized modifications of application data, persistent backdoors via stored malicious scripts, and a significant threat to the application's integrity. Users are advised to update to InvoicePlane version 1.7.1, which effectively addresses this issue.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References