CVE-2026-24744: 
NixOS vulnerability analysis and mitigation

CVE-2026-24744 is a Stored Cross-Site Scripting (XSS) vulnerability in InvoicePlane version 1.7.0, affecting the Edit Invoices functionality. The flaw was discovered by security researcher Nguyen Truong Son (truongson526@gmail.com) on January 24, 2026, and publicly disclosed via a GitHub Security Advisory on February 16, 2026. Only InvoicePlane version 1.7.0 is confirmed affected; version 1.7.1 patches the issue. The CVSS v3.1 base score is 7.5 (High) per Feedly data, though the GitHub advisory rates it 5.7 (Moderate) (GitHub Advisory, Feedly).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting). The root cause is a failure to validate or sanitize user-supplied input in the invoice_number parameter within the Edit Invoices function, allowing malicious script content to be stored in the application database and rendered in the browser without proper output encoding. Exploitation requires an authenticated administrator to submit a crafted payload via a POST request to /invoiceplane/index.php/invoices/ajax/save, with the invoice_number field containing a script tag (e.g., "><script>alert(1)</script>). The stored payload executes in the browser of any user who subsequently views the affected invoice (GitHub Advisory).

Successful exploitation allows an authenticated administrator to inject persistent malicious scripts that execute in the context of other users' browser sessions when they view the affected invoice. This can lead to unauthorized modification of application data, session hijacking, creation of persistent backdoors through stored scripts, and full compromise of the application's integrity. Confidentiality impact is low (limited data exposure), integrity impact is high (data modification possible), and availability impact is low (GitHub Advisory, Feedly).

A proof-of-concept (PoC) exploit is publicly available in the GitHub Security Advisory, demonstrating the XSS payload in the invoice_number field. There is no evidence of in-the-wild exploitation at this time, and the vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.031% (0.000310), indicating a low probability of exploitation in the near term. Exploitation requires administrator-level authentication and user interaction (a victim must view the poisoned invoice) (GitHub Advisory, Feedly).

1. Authenticate as Administrator: Log in to the InvoicePlane 1.7.0 instance with administrator credentials.
2. Navigate to Invoice Editing: Open an existing invoice for editing via the application's invoice management interface.
3. Inject XSS Payload: In the Invoice # (invoice_number) field, enter a malicious payload such as "><script>alert(document.cookie)</script> or a more sophisticated payload for session theft or backdoor creation.
4. Submit the Form: Save the invoice, which sends a POST request to /invoiceplane/index.php/invoices/ajax/save with the crafted invoice_number parameter. The payload is stored in the application database without sanitization.
5. Trigger Execution: When any user (including other administrators or clients with access) views the affected invoice, the stored script executes in their browser context, enabling session hijacking, data exfiltration, or further malicious actions (GitHub Advisory).

• Network: Unusual POST requests to /invoiceplane/index.php/invoices/ajax/save containing HTML/script tags or encoded XSS payloads in the invoice_number parameter.
• Logs: Web server access logs showing POST requests to the invoice save endpoint with anomalous or encoded content in form parameters; application logs recording unexpected input sanitization events (in patched versions with logging enabled).
• Application Data: Invoice records in the database where the invoice_number field contains HTML tags, script elements, or JavaScript event handlers (e.g., <script>, onerror=, javascript:).
• Browser/User Reports: Users reporting unexpected alert dialogs, redirects, or unusual behavior when viewing invoices.

Upgrade InvoicePlane to version 1.7.1, which addresses this vulnerability by implementing proper output encoding (using htmlsc() / htmlspecialchars) for the invoice_number parameter and other user-controlled fields, as well as backend input sanitization (GitHub Patch). If immediate patching is not possible, restrict administrative access to trusted users only and implement network segmentation to limit exposure of the InvoicePlane application. Additionally, enforce a strong Content Security Policy (CSP) to restrict inline script execution as a defense-in-depth measure (GitHub Advisory).