CVE-2026-85293: InvoicePlane XSS Vulnerability

CVE-2026-85293 Overview

CVE-2026-85293 is a stored cross-site scripting (XSS) vulnerability [CWE-79] in InvoicePlane, a self-hosted open source application for managing invoices, clients, and payments. Version 1.7.2-beta-1 stores client_email values without validating email syntax. The application then renders these values unescaped inside double-quoted value attributes within the invoice mailer and quote mailer forms. An administrator who can edit a client can inject attribute-breaking input. When another authenticated administrator opens the related mailer page, JavaScript executes in the InvoicePlane origin. The injected script can perform same-origin actions using the victim's session. The issue is fixed in version 1.7.2.

Critical Impact
Authenticated attackers with client-edit privileges can store malicious payloads that execute in a victim administrator's browser session, enabling session abuse and unauthorized same-origin actions.

Affected Products

InvoicePlane 1.7.2-beta-1
Fixed in InvoicePlane 1.7.2

Discovery Timeline

2026-09-25 - CVE-2026-85293 published to NVD
2026-09-28 - Last updated in NVD database

Technical Details for CVE-2026-85293

Vulnerability Analysis

The vulnerability resides in the mailer views of InvoicePlane. The client_email field is persisted through the client management form without input validation. When a mailer page is rendered, the stored value is echoed directly into the value attribute of an <input type="email"> element without HTML encoding. An attacker who controls client data can supply a payload containing a double quote followed by additional attributes or inline event handlers. This breaks out of the attribute context and injects executable JavaScript into the DOM. Because the script executes in the InvoicePlane origin, it can read authenticated session state and issue requests on behalf of the victim administrator.

Root Cause

Two defects combine to produce the flaw. First, the Mdl_clients model does not enforce a valid_email validation rule on the client_email field, allowing arbitrary strings to be stored. Second, the mailer views echo $invoice->client_email using raw PHP output rather than passing the value through the htmlsc() escaping helper. Together these omissions produce a classic stored XSS sink.

Attack Vector

Exploitation requires an authenticated administrator with permission to edit clients, user interaction from a second administrator who opens the invoice or quote mailer, and a mailer configuration that renders the affected view. The scope changes because code executes in the context of a different user's authenticated session.

php

// Patch 1: Mdl_clients.php - enforce email validation
'client_email' => [
    'field' => 'client_email',
+   'label' => trans('email_address'),
+   'rules' => 'trim|valid_email',
],

php

// Patch 2: mailer/views/invoice.php - escape output in attribute context
<input type="email" multiple name="to_email" id="to_email" class="form-control" required
-      value="<?php echo $invoice->client_email; ?>">
+      value="<?php echo htmlsc($invoice->client_email); ?>">

Source: GitHub Commit 1e74c032

Detection Methods for CVE-2026-85293

Indicators of Compromise

Client records whose client_email field contains characters outside normal RFC 5322 syntax, such as ", <, >, or on*= event handler fragments.
Browser console errors or unexpected network requests originating from the invoice or quote mailer pages.
Audit log entries showing client edits immediately followed by administrator visits to /mailer/invoice or /mailer/quote endpoints.

Detection Strategies

Query the ip_clients table for client_email values that fail a strict email regex to surface injected payloads.
Inspect HTTP responses from mailer views for unescaped quotes or script fragments inside the to_email input value attribute.
Review web server access logs for POST /clients/form requests containing URL-encoded quote characters in the client_email parameter.

Monitoring Recommendations

Enable a Content Security Policy that blocks inline script execution and report violations to a centralized collector.
Alert on administrator account activity that performs client edits followed by rapid session actions from a different source IP.
Monitor InvoicePlane version strings across deployments to confirm hosts are running 1.7.2 or later.

How to Mitigate CVE-2026-85293

Immediate Actions Required

Upgrade all InvoicePlane instances to version 1.7.2 or later, which applies both the validation rule and the output escaping fix.
Audit the ip_clients table and remove or sanitize any client_email values that contain HTML metacharacters.
Rotate administrator session tokens and credentials if evidence of exploitation is found.

Patch Information

The fix is included in InvoicePlane Release v1.7.2 via Pull Request #1635 and commit 1e74c032. See the GHSA-477r-xmgc-vcvj advisory for full details.

Workarounds

Restrict client-editing permissions to a minimal set of trusted administrators until the patch is applied.
Temporarily disable the invoice and quote mailer features in configuration to prevent rendering of the vulnerable views.
Place InvoicePlane behind a web application firewall with rules that reject non-RFC-5322 characters in the client_email parameter.

bash

# Upgrade to the patched release
cd /var/www/invoiceplane
wget https://github.com/InvoicePlane/InvoicePlane/releases/download/v1.7.2/InvoicePlane-1.7.2.zip
unzip -o InvoicePlane-1.7.2.zip
php index.php setup