Stored Cross-Site Scripting Vulnerability in InvoicePlane Application
CVE-2026-24745

5.7MEDIUM

Key Information:

Vendor

Invoiceplane

Status
Invoiceplane
Vendor
CVE Published:
18 February 2026

What is CVE-2026-24745?

InvoicePlane is a self-hosted, open-source application designed for managing invoices, clients, and payments. It is affected by a Stored Cross-Site Scripting (XSS) vulnerability specifically in its Upload Login Logo function. This vulnerability allows unauthorized users, provided they possess administrator privileges, to upload SVG files. The exploit could lead to unauthorized modifications of application data, persistent backdoors via stored malicious scripts, and a significant threat to the application's integrity. Users are advised to update to InvoicePlane version 1.7.1, which effectively addresses this issue.

Affected Version(s)

InvoicePlane = 1.7.0

References

https://github.com/InvoicePlane/InvoicePlane/security/adv...
x_refsource_CONFIRM
https://github.com/InvoicePlane/InvoicePlane/commit/93622...
x_refsource_MISC

CVSS V3.1

Score:
5.7
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.