CVE-2026-24745

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24745", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-26T19:06:16.059Z", "datePublished": "2026-02-18T22:47:19.717Z", "dateUpdated": "2026-02-19T16:14:50.756Z"}, "containers": {"cna": {"title": "InvoicePlane has a Stored Cross-Site Scripting (XSS) issue", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:H/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/InvoicePlane/InvoicePlane/security/advisories/GHSA-r9rq-f946-6x54", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/InvoicePlane/InvoicePlane/security/advisories/GHSA-r9rq-f946-6x54"}, {"name": "https://github.com/InvoicePlane/InvoicePlane/commit/93622f2df88a860d89bfee56012cabb2942061d6", "tags": ["x_refsource_MISC"], "url": "https://github.com/InvoicePlane/InvoicePlane/commit/93622f2df88a860d89bfee56012cabb2942061d6"}], "affected": [{"vendor": "InvoicePlane", "product": "InvoicePlane", "versions": [{"version": "= 1.7.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-18T22:47:19.717Z"}, "descriptions": [{"lang": "en", "value": "InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting (XSS) vulnerability occurs in the upload Login Logo functions of InvoicePlane version 1.7.0. In the Upload Login Logo, the application allows uploading svg files. Although administrator privileges are required to exploit it, this is still considered a critical vulnerability as it can cause actions such as unauthorized modification of application data, creation of persistent backdoors through stored malicious scripts, and full compromise of the application's integrity. Version 1.7.1 patches the issue."}], "source": {"advisory": "GHSA-r9rq-f946-6x54", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-19T16:13:01.232137Z", "id": "CVE-2026-24745", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-19T16:14:50.756Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-24745", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-19T16:13:01.232137Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-19T16:14:43.004Z"}}], "cna": {"title": "InvoicePlane has a Stored Cross-Site Scripting (XSS) issue", "source": {"advisory": "GHSA-r9rq-f946-6x54", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.7, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "InvoicePlane", "product": "InvoicePlane", "versions": [{"status": "affected", "version": "= 1.7.0"}]}], "references": [{"url": "https://github.com/InvoicePlane/InvoicePlane/security/advisories/GHSA-r9rq-f946-6x54", "name": "https://github.com/InvoicePlane/InvoicePlane/security/advisories/GHSA-r9rq-f946-6x54", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/InvoicePlane/InvoicePlane/commit/93622f2df88a860d89bfee56012cabb2942061d6", "name": "https://github.com/InvoicePlane/InvoicePlane/commit/93622f2df88a860d89bfee56012cabb2942061d6", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting (XSS) vulnerability occurs in the upload Login Logo functions of InvoicePlane version 1.7.0. In the Upload Login Logo, the application allows uploading svg files. Although administrator privileges are required to exploit it, this is still considered a critical vulnerability as it can cause actions such as unauthorized modification of application data, creation of persistent backdoors through stored malicious scripts, and full compromise of the application's integrity. Version 1.7.1 patches the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-18T22:47:19.717Z"}}}, "cveMetadata": {"cveId": "CVE-2026-24745", "state": "PUBLISHED", "dateUpdated": "2026-02-19T16:14:50.756Z", "dateReserved": "2026-01-26T19:06:16.059Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-18T22:47:19.717Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "InvoicePlane", "vendor": "InvoicePlane", "versions": [{"status": "affected", "version": "= 1.7.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:invoiceplane:invoiceplane:1.7.0:-:*:*:*:*:*:*", "matchCriteriaId": "95F739B4-399F-459D-BF16-5E225A268320", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting (XSS) vulnerability occurs in the upload Login Logo functions of InvoicePlane version 1.7.0. In the Upload Login Logo, the application allows uploading svg files. Although administrator privileges are required to exploit it, this is still considered a critical vulnerability as it can cause actions such as unauthorized modification of application data, creation of persistent backdoors through stored malicious scripts, and full compromise of the application's integrity. Version 1.7.1 patches the issue."}, {"lang": "es", "value": "InvoicePlane es una aplicaci\u00f3n de c\u00f3digo abierto autoalojada para gestionar facturas, clientes y pagos. Una vulnerabilidad de cross-site scripting (XSS) almacenado ocurre en las funciones de carga del logotipo de inicio de sesi\u00f3n de InvoicePlane versi\u00f3n 1.7.0. En la carga del logotipo de inicio de sesi\u00f3n, la aplicaci\u00f3n permite cargar archivos svg. Aunque se requieren privilegios de administrador para explotarla, esto todav\u00eda se considera una vulnerabilidad cr\u00edtica ya que puede causar acciones como modificaci\u00f3n no autorizada de datos de la aplicaci\u00f3n, creaci\u00f3n de puertas traseras persistentes a trav\u00e9s de scripts maliciosos almacenados y compromiso total de la integridad de la aplicaci\u00f3n. La versi\u00f3n 1.7.1 corrige el problema."}], "id": "CVE-2026-24745", "lastModified": "2026-06-17T10:23:31.547", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:H/A:L", "version": "3.1"}, "exploitabilityScore": 0.9, "impactScore": 4.7, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:H/A:L", "version": "3.1"}, "exploitabilityScore": 1.7, "impactScore": 5.3, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24745", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-19T16:13:01.232137Z", "version": "2.0.3"}}]}, "published": "2026-02-18T23:16:19.407", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/InvoicePlane/InvoicePlane/commit/93622f2df88a860d89bfee56012cabb2942061d6"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/InvoicePlane/InvoicePlane/security/advisories/GHSA-r9rq-f946-6x54"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.7.0"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "InvoicePlane", "source": "cna", "vendor": "InvoicePlane"}, "product": "invoiceplane", "vendor": "invoiceplane"}], "analysis": {"en": {"generated_at": "2026-04-17T18:24:31.884584+00:00", "value": {"mitigation_remediation": ["Upgrade to InvoicePlane 1.7.1 or later to eliminate the vulnerability.", "If upgrading immediately is not feasible, block SVG uploads for the login logo or enforce strict MIME type validation to exclude XML-based content.", "Restrict administrator accounts, audit upload activity, and monitor for unauthorized login\u2011logo changes."], "summary": {"action": "Patch", "impact": "Stored Cross\u2011Site Scripting allowing execution of malicious scripts in the application context"}, "threat_synthesis": {"affected_systems": "The affected product is the self\u2011hosted open\u2011source InvoicePlane application, specifically version 1.7.0. Version 1.7.1 includes a patch that resolves the issue. No other versions are listed as affected.", "description_and_impact": "InvoicePlane 1.7.0 permits administrators to upload SVG files as the login logo; an attacker can embed malicious SVG containing script, which is then rendered and stored in the system. When any user accesses the site, the malicious code executes under the user's browser context, enabling the attacker to modify application data, create persistent backdoors, or otherwise compromise the application's integrity. This vulnerability aligns with CWE\u201179, representing a stored XSS flaw.", "risk_and_exploitability": "The CVSS score of 5.7 reflects moderate impact, while the EPSS score of less than 1% indicates a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires administrator privileges to upload a malicious SVG; once stored, the script runs for all users, making the attack vector administrative and file\u2011upload based rather than public network accessible."}}}}, "created": "2026-02-19T10:10:33.777537+00:00", "updated": "2026-04-17T18:30:05.654989+00:00", "vendors": ["invoiceplane", "invoiceplane$PRODUCT$invoiceplane"]}