CVE-2026-24743: 
NixOS vulnerability analysis and mitigation

CVE-2026-24743 is a Stored Cross-Site Scripting (XSS) vulnerability in InvoicePlane version 1.7.0, affecting the Upload Invoice Logo function within System Settings. The flaw allows an authenticated administrator to upload a malicious SVG file containing embedded scripts, which are then stored and executed in the browser of any user who views the logo. It was discovered by security researcher Nguyen Truong Son (truongson526@gmail.com) on January 24, 2026, and publicly disclosed via a GitHub Security Advisory on February 16, 2026. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) per Feedly/NVD, though the GitHub advisory scores it at 5.7 (Moderate) (GitHub Advisory, Feedly).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically the application's failure to validate or sanitize SVG file content during the invoice logo upload process. SVG files are XML-based and can contain embedded <script> tags or event handlers that execute JavaScript when rendered in a browser. An attacker with administrator credentials can upload a crafted SVG payload via a POST request to /invoiceplane/index.php/settings with the invoice_logo form field, and the malicious script executes when any user opens the uploaded image in a browser tab. The GitHub advisory includes a proof-of-concept demonstrating a simple alert(1) payload embedded in an SVG file (GitHub Advisory).

Successful exploitation enables persistent script execution in the context of any user's browser session who views the malicious logo, including other administrators. This can lead to unauthorized modification of application data, theft of session tokens or credentials, creation of persistent backdoors via stored malicious scripts, and full compromise of the application's integrity. Confidentiality impact is low (limited data exposure), integrity impact is high (data modification possible), and availability impact is low (GitHub Advisory, Feedly).

A proof-of-concept exploit is publicly available via the GitHub Security Advisory, demonstrating SVG-based XSS payload delivery. Exploitation requires administrator-level authentication and user interaction (a victim must open the uploaded image in a new browser tab), limiting opportunistic exploitation. There is no evidence of active in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is 0.031% (very low probability of exploitation in the near term), and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (GitHub Advisory, Feedly).

1. Authenticate as Administrator: Log in to the InvoicePlane 1.7.0 instance using valid administrator credentials.
2. Prepare Malicious SVG: Create an SVG file containing an embedded XSS payload, for example:

<svg xmlns="http://www.w3.org/2000/svg">
  <script>alert(document.cookie);</script>
</svg>

3. Navigate to Upload Function: Go to System Settings → Invoices and locate the Invoice Logo upload field.
4. Upload the Malicious SVG: Submit the crafted SVG file via the invoice logo upload form (POST request to /invoiceplane/index.php/settings with invoice_logo as the file field name).
5. Trigger Execution: The SVG is stored on the server. Any user (including other admins) who right-clicks the logo and selects "Open image in new tab" will trigger execution of the embedded script in their browser context.
6. Achieve Objective: The executed script can steal session cookies, perform actions on behalf of the victim, or establish a persistent backdoor by adding rogue admin accounts (GitHub Advisory).

• Network: Unusual POST requests to /invoiceplane/index.php/settings uploading .svg files, especially with unexpected or obfuscated filenames; outbound requests from user browsers to unknown external domains following logo viewing.
• File System: Presence of SVG files in the invoice logo upload directory containing <script>, onerror, onload, or javascript: strings; multiple SVG files with auto-incremented names (e.g., xss2.svg, xss3.svg) indicating repeated upload attempts.
• Logs: Web server access logs showing POST requests to the settings endpoint with SVG file uploads from administrator accounts; application logs recording SVG upload events (version 1.7.1 adds security logging for SVG uploads).
• Browser/Application: Unexpected JavaScript alert dialogs or console errors when viewing the invoice logo; unexplained changes to admin account settings or new administrator accounts created without authorization (GitHub Advisory, Patch Commit).

The primary remediation is to upgrade InvoicePlane from version 1.7.0 to version 1.7.1, which blocks SVG files from being uploaded as invoice logos and prevents existing malicious SVGs from rendering (Patch Commit). As interim workarounds, restrict administrator account access to trusted personnel only, implement a Content Security Policy (CSP) header to limit inline script execution, and review the logo upload directory for any existing SVG files with embedded scripts. Additionally, implementing server-side input validation to reject SVG uploads and applying output encoding (e.g., htmlspecialchars) for all user-controlled data before rendering are recommended defensive measures (GitHub Advisory).