CVE-2026-24745
📋 TL;DR
InvoicePlane 1.7.0 contains a stored XSS vulnerability in the Login Logo upload function that accepts SVG files. An authenticated administrator can upload malicious SVG files that execute JavaScript when viewed, potentially compromising the application. This affects all InvoicePlane 1.7.0 installations.
💻 Affected Systems
- InvoicePlane
📦 What is this software?
Invoiceplane by Invoiceplane
⚠️ Risk & Real-World Impact
Worst Case
Full application compromise through persistent malicious scripts, data theft/modification, account takeover, and backdoor creation.
Likely Case
Unauthorized data modification, session hijacking, and privilege escalation within the application.
If Mitigated
Limited impact due to administrator-only access requirement and proper input validation.
🎯 Exploit Status
Exploitation requires administrator access. SVG files with embedded JavaScript can be uploaded and executed when viewed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.7.1
Vendor Advisory: https://github.com/InvoicePlane/InvoicePlane/security/advisories/GHSA-r9rq-f946-6x54
Restart Required: No
Instructions:
1. Backup your InvoicePlane installation and database. 2. Download InvoicePlane 1.7.1 from the official repository. 3. Replace all files with the 1.7.1 version. 4. Run database migrations if required. 5. Verify the fix by checking the version.
🔧 Temporary Workarounds
Disable SVG uploads
allModify application configuration to block SVG file uploads in the Login Logo function.
Edit application configuration to restrict file uploads to non-SVG formats
Restrict administrator access
allLimit administrator accounts and implement strong authentication controls.
🧯 If You Can't Patch
- Disable the Login Logo upload functionality completely
- Implement web application firewall rules to block malicious SVG content
🔍 How to Verify
Check if Vulnerable:
Check if running InvoicePlane version 1.7.0 by viewing the version in the application footer or configuration files.Check Version:
Check application footer or config.php for version informationVerify Fix Applied:
Confirm installation of version 1.7.1 and verify SVG uploads are properly sanitized or blocked.📡 Detection & Monitoring
Log Indicators:
- Unusual SVG file uploads to login logo endpoint
- Administrator account activity during off-hours
Network Indicators:
- HTTP POST requests to upload endpoints with SVG content
- Unexpected JavaScript execution in application responses
SIEM Query:
source="invoiceplane" AND (url_path="/upload/login_logo" OR file_extension="svg")