CVE-2026-24744
Published: 18 February 2026
Summary
CVE-2026-24744 is a medium-severity Cross-site Scripting (CWE-79) vulnerability in Invoiceplane Invoiceplane. Its CVSS base score is 5.7 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique JavaScript (T1059.007); ranked at the 18.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2026-24744 is a Stored Cross-Site Scripting (XSS) vulnerability, classified under CWE-79, affecting InvoicePlane version 1.7.0, a self-hosted open source application for managing invoices, clients, and payments. The flaw occurs in the Edit Invoices functions, where the application fails to validate user input in the `invoice_number` parameter, enabling the injection of malicious scripts. Published on 2026-02-18, it carries a CVSS v3.1 base score of 5.7 (AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:H/A:L).
Exploitation requires administrator privileges, allowing a malicious admin to inject XSS payloads via the vulnerable parameter. Successful attacks can lead to unauthorized modification of application data, creation of persistent backdoors through stored malicious scripts, and full compromise of the application's integrity, particularly when combined with user interaction from other admins or users viewing affected invoices.
InvoicePlane version 1.7.1 patches the issue by addressing the input validation deficiency. Security practitioners should review the fixing commit at https://github.com/InvoicePlane/InvoicePlane/commit/93622f2df88a860d89bfee56012cabb2942061d6 and the GitHub security advisory at https://github.com/InvoicePlane/InvoicePlane/security/advisories/GHSA-5mxx-553h-m62w for implementation details and upgrade guidance.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-8391
Vulnerability details
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting (XSS) vulnerability occurs in the Edit Invoices functions of InvoicePlane version 1.7.0. When editing invoices, the application does not validate user input at…
more
the `invoice_number` parameter. Although administrator privileges are required to exploit it, this is still considered a critical vulnerability as it can cause actions such as unauthorized modification of application data, creation of persistent backdoors through stored malicious scripts, and full compromise of the application's integrity. Version 1.7.1 patches the issue.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stored XSS enables arbitrary JavaScript injection/execution in other users' browsers (T1059.007) and directly facilitates browser session hijacking or input capture via malicious scripts persisted in invoice data (T1185).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of the invoice_number input parameter before processing, which is the precise deficiency enabling the stored XSS injection.
Requires filtering/sanitization of data (including invoice_number values) on output to users, blocking execution of any stored malicious scripts.
Mandates integrity verification mechanisms that can detect unauthorized script insertion or modification of invoice data.