CVE-2026-24743: InvoicePlane has a Stored Cross-Site Scripting (XSS) issue
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting (XSS) vulnerability occurs in the upload Invoice Logo functions of InvoicePlane version 1.7.0. The Upload Invoice Logo function allows the application to upload svg files. Although administrator privileges are required to exploit it, this is still considered a critical vulnerability as it can cause actions such as unauthorized modification of application data, creation of persistent backdoors through stored malicious scripts, and full compromise of the application's integrity. Version 1.7.1 patches the issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-24743?
CVE-2026-24743 is classified as a high severity vulnerability due to its impact on user data and the potential for exploitation via stored XSS attacks.
How do I fix CVE-2026-24743?
To mitigate CVE-2026-24743, upgrade InvoicePlane to version 1.7.1 or later, where the vulnerability has been addressed.
What versions of InvoicePlane are affected by CVE-2026-24743?
CVE-2026-24743 affects InvoicePlane version 1.7.0.
What impact does CVE-2026-24743 have on users?
The impact of CVE-2026-24743 allows attackers to execute scripts in the context of the affected user, potentially leading to data theft or manipulation.
How can I identify if my system is vulnerable to CVE-2026-24743?
You can identify if your system is vulnerable to CVE-2026-24743 by checking if you are using InvoicePlane version 1.7.0 or earlier.