CVE-2026-24746: InvoicePlane has a Stored Cross-Site Scripting (XSS) issue

Published Feb 18, 2026

Updated

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting (XSS) vulnerability occurs in the Edit Quotes functions of InvoicePlane version 1.7.0. In the Editing Quotes function, the application does not validate user input at the quotenumber parameter. Although administrator privileges are required to exploit it, this is still considered a critical vulnerability as it can cause actions such as unauthorized modification of application data, creation of persistent backdoors through stored malicious scripts, and full compromise of the application's integrity. Version 1.7.1 patches the issue.

Affected Software

2 affected components

InvoicePlane InvoicePlane

InvoicePlane InvoicePlane=1.7.0

Remediation

Patch Available

https://github.com/InvoicePlane/InvoicePlane/commit/93622f2df88a860d89bfee56012cabb2942061d6

Event History

Feb 18, 2026

CVE Published

via MITRE·08:51 PM

Data Sourced

via MITRE·08:51 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·09:16 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2026-24746?

CVE-2026-24746 is considered to have a medium severity due to its ability to be exploited with administrator privileges.

How do I fix CVE-2026-24746?

To fix CVE-2026-24746, update to the latest version of InvoicePlane which addresses this stored XSS vulnerability.

What versions of InvoicePlane are affected by CVE-2026-24746?

CVE-2026-24746 affects InvoicePlane version 1.7.0.

What type of vulnerability is CVE-2026-24746?

CVE-2026-24746 is classified as a Stored Cross-Site Scripting (XSS) vulnerability.

Who can exploit CVE-2026-24746?

Exploitation of CVE-2026-24746 requires administrator privileges.