CVE-2026-24746: InvoicePlane Stored XSS Vulnerability

CVE-2026-24746 Overview

A Stored Cross-Site Scripting (XSS) vulnerability has been identified in InvoicePlane, a self-hosted open source application for managing invoices, clients, and payments. The vulnerability exists in the Edit Quotes functionality of InvoicePlane version 1.7.0, where the application fails to properly validate user input at the quote_number parameter.

Critical Impact

Although administrator privileges are required to exploit this vulnerability, successful exploitation can result in unauthorized modification of application data, creation of persistent backdoors through stored malicious scripts, and full compromise of the application's integrity.

Affected Products

• InvoicePlane version 1.7.0
• InvoicePlane versions prior to 1.7.1

Discovery Timeline

• 2026-02-18 - CVE-2026-24746 published to NVD
• 2026-02-19 - Last updated in NVD database

Technical Details for CVE-2026-24746

Vulnerability Analysis

This Stored XSS vulnerability (CWE-79) occurs when processing quote data through the Edit Quotes function. The application accepts user-supplied input in the quote_number field without proper sanitization or encoding, allowing malicious JavaScript code to be stored in the database and executed whenever the affected quote is viewed.

The vulnerability requires network access and user interaction to exploit, with the attacker needing high privileges (administrator access). While the privilege requirement limits the attack surface, the persistent nature of stored XSS makes this particularly dangerous—once injected, the malicious payload executes automatically for any user viewing the compromised quote entry.

Root Cause

The root cause of this vulnerability is improper input validation in the quote editing functionality. The quote_number parameter is not sanitized before being stored in the database, allowing HTML and JavaScript injection. This violates the principle of never trusting user input, even from authenticated administrative users.

Attack Vector

The attack is network-based, requiring an authenticated administrator to access the Edit Quotes functionality. An attacker with administrative credentials can inject malicious JavaScript through the quote_number field. The payload is then stored in the application database and executes in the browser context of any user who subsequently views the quote, potentially including other administrators.

The security patch in version 1.7.1 addresses input validation in the form processing library:

 
     public function run($config = null, &$data = null)
     {
-        if (is_object($config)) {
-            $this->CI = &$config;
-        }
+        (is_object($config)) && $this->CI = &$config;
 
         return parent::run($data);
     }

Source: GitHub Commit Update

Detection Methods for CVE-2026-24746

Indicators of Compromise

• Unusual JavaScript or HTML tags present in the quote_number field values in the database
• Quote records containing <script> tags, event handlers (e.g., onerror, onload), or encoded payloads
• Unexpected outbound connections from client browsers when viewing quote pages
• Reports of unexpected browser behavior when accessing quote management features

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect XSS payloads in POST requests to quote editing endpoints
• Monitor database fields for HTML/JavaScript injection patterns using regular expression matching
• Enable Content Security Policy (CSP) headers with violation reporting to detect XSS execution attempts
• Review audit logs for suspicious quote editing activity, particularly from administrator accounts

Monitoring Recommendations

• Configure application logging to capture all quote modification events with full parameter values
• Implement database activity monitoring to alert on suspicious content being inserted into quote fields
• Enable browser-based XSS auditing and CSP violation reporting
• Monitor for anomalous administrator session activity that could indicate credential compromise

How to Mitigate CVE-2026-24746

Immediate Actions Required

• Upgrade InvoicePlane to version 1.7.1 or later immediately
• Audit existing quote records in the database for stored XSS payloads
• Review administrator account activity for signs of compromise
• Implement Content Security Policy headers as a defense-in-depth measure

Patch Information

The vulnerability is patched in InvoicePlane version 1.7.1. The fix includes improved input validation in the form validation library. Users should upgrade by downloading the latest release from the official InvoicePlane repository or applying the security commit referenced in the GitHub Security Advisory GHSA-73x8-gr6v-vjvj.

Workarounds

• Restrict administrator account access to trusted users only until the patch can be applied
• Implement Web Application Firewall rules to filter XSS payloads in request parameters
• Enable Content Security Policy headers to mitigate the impact of any stored XSS
• Manually audit and sanitize existing quote_number field values in the database

# Configuration example - Add CSP headers to Apache
# Add to .htaccess or virtual host configuration
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'"
Header set X-XSS-Protection "1; mode=block"
Header set X-Content-Type-Options "nosniff"