Stored Cross-Site Scripting Vulnerability in SolidInvoice Invoicing Platform
CVE-2026-46489

8.1HIGH

Key Information:

Vendor

Solidinvoice

Status
Solidinvoice
Vendor
CVE Published:
11 June 2026

What is CVE-2026-46489?

SolidInvoice, an open-source invoicing platform, has a vulnerability that allows authenticated administrators to upload SVG files without validation. This flaw permits the injection of base64-encoded JavaScript into the application, leading to stored cross-site scripting. When executed, this script runs in the browsers of all authenticated users, potentially compromising their data security. The issue has been resolved in version 2.3.17, emphasizing the importance of prompt updates for users.

Affected Version(s)

SolidInvoice < 2.3.17

References

https://github.com/SolidInvoice/SolidInvoice/security/adv...
x_refsource_CONFIRM
https://github.com/SolidInvoice/SolidInvoice/commit/8196c...
x_refsource_MISC
https://github.com/SolidInvoice/SolidInvoice/releases/tag...
x_refsource_MISC

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.