CVE-2026-24745: InvoicePlane has a Stored Cross-Site Scripting (XSS) issue
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting (XSS) vulnerability occurs in the upload Login Logo functions of InvoicePlane version 1.7.0. In the Upload Login Logo, the application allows uploading svg files. Although administrator privileges are required to exploit it, this is still considered a critical vulnerability as it can cause actions such as unauthorized modification of application data, creation of persistent backdoors through stored malicious scripts, and full compromise of the application's integrity. Version 1.7.1 patches the issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-24745?
The severity of CVE-2026-24745 is classified as moderate due to the potential for Stored Cross-Site Scripting vulnerabilities.
How do I fix CVE-2026-24745?
To fix CVE-2026-24745, upgrade InvoicePlane to the latest version that includes patches for this vulnerability.
Which versions of InvoicePlane are affected by CVE-2026-24745?
CVE-2026-24745 affects InvoicePlane version 1.7.0.
What is a Stored Cross-Site Scripting vulnerability in CVE-2026-24745?
A Stored Cross-Site Scripting vulnerability allows an attacker to inject malicious scripts that are stored and executed in the context of other users.
What are the potential impacts of CVE-2026-24745?
The potential impacts of CVE-2026-24745 include unauthorized access to user data, session hijacking, and defacement of web pages.