CVE-2026-85293: InvoicePlane: Stored Cross-Site Scripting (XSS) via Client Email in Invoice and Quote Mailer Forms
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. In version 1.7.2-beta-1, InvoicePlane stores clientemail values without enforcing email syntax and renders them unescaped inside double-quoted value attributes in the invoice mailer form and quote mailer form. An administrator who can edit a client can store attribute-breaking input, and, when the mailer is configured, JavaScript executes when another authenticated administrator opens the related mailer page. The script runs in the InvoicePlane origin and can perform same-origin actions with the victim's session. This issue is fixed in version 1.7.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
InvoicePlaneto a version that resolves this vulnerability.Fixed in 1.7.2
Event History
Frequently Asked Questions
Who is exposed to this issue?
InvoicePlane 1.7.2-beta-1 installations are exposed where an administrator can edit client records and another authenticated administrator can open the related invoice or quote mailer page. Exploitation requires the mailer to be configured.
What does an attacker need to exploit it?
The attacker needs administrator-level access that permits editing a client, plus the ability to set a client_email value containing attribute-breaking input. A separate authenticated administrator must then open the affected mailer page.
What is the impact after successful exploitation?
JavaScript executes in the InvoicePlane origin with the victim administrator's session. It can perform same-origin actions available to that victim.
How can I tell whether I may be affected?
Check whether the deployment is running version 1.7.2-beta-1 and whether invoice or quote mailer functionality is configured. Review client_email fields for values that do not conform to expected email syntax, especially values containing quote characters or HTML-like input.
What should I do if I cannot patch immediately?
Restrict administrator access to client editing and avoid opening invoice or quote mailer pages for clients whose email values have not been reviewed. Validate and clean existing client_email values to ensure they contain only valid email addresses.