CVE-2026-24746 InvoicePlane has a Stored Cross-Site Scripting (XSS) issue

Medium 5.7 Published 18 Feb 2026 Updated 18 Feb 2026

Attackers with admin privileges can inject malicious scripts via the quote_number parameter, leading to data modification and potential application compromise.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2026-24746?

CVE-2026-24746 is a medium-severity cross-site scripting vulnerability in InvoicePlane, published on 18 Feb 2026. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.

Official description

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting (XSS) vulnerability occurs in the Edit Quotes functions of InvoicePlane version 1.7.0. In the Editing Quotes function, the application does not validate user input at the quote_number parameter. Although administrator privileges are required to exploit it, this is still considered a critical vulnerability as it can cause actions such as unauthorized modification of application data, creation of persistent backdoors through stored malicious scripts, and full compromise of the application's integrity. Version 1.7.1 patches the issue.

Weakness: CWE-79

Which versions are affected by CVE-2026-24746?

It affects 1 product.

Products include Invoiceplane Invoiceplane.

How do I fix CVE-2026-24746?

No fix has been published for CVE-2026-24746 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2026-24746 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-24746 exists.

Sources

Also known as GHSA-73x8-gr6v-vjvj.