CVE-2026-24744 InvoicePlane has a Stored Cross-Site Scripting (XSS) issue
Attackers with admin privileges can inject malicious scripts via the invoice number field, leading to data modification and potential application compromise.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-24744?
CVE-2026-24744 is a medium-severity cross-site scripting vulnerability in InvoicePlane, published on 18 Feb 2026. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting (XSS) vulnerability occurs in the Edit Invoices functions of InvoicePlane version 1.7.0. When editing invoices, the application does not validate user input at the `invoice_number` parameter. Although administrator privileges are required to exploit it, this is still considered a critical vulnerability as it can cause actions such as unauthorized modification of application data, creation of persistent backdoors through stored malicious scripts, and full compromise of the application's integrity. Version 1.7.1 patches the issue.
Weakness: CWE-79
Which versions are affected by CVE-2026-24744?
It affects 1 product.
Products include Invoiceplane Invoiceplane.
How do I fix CVE-2026-24744?
No fix has been published for CVE-2026-24744 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-24744 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-24744 exists.
Other vulnerabilities in InvoicePlane
Sources
Also known as GHSA-5mxx-553h-m62w.