CVE-2026-24745: 
NixOS vulnerability analysis and mitigation

CVE-2026-24745 is a Stored Cross-Site Scripting (XSS) vulnerability in InvoicePlane version 1.7.0, affecting the Upload Login Logo function within System Settings. The flaw allows an authenticated administrator to upload a malicious SVG file containing embedded scripts that persist in the application and execute in other users' browsers. It was discovered by security researcher Nguyen Truong Son (truongson526@gmail.com) on January 24, 2026, and publicly disclosed via a GitHub Security Advisory on February 16, 2026. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) per Feedly/NVD, though the GitHub advisory rates it 5.7 (Moderate) (GitHub Advisory, Feedly).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), where the application fails to validate or sanitize SVG file uploads in the Login Logo upload function, allowing embedded <script> tags within SVG content to be stored and later rendered in users' browsers (GitHub Advisory). The attack vector is network-based, requiring high privileges (administrator) and user interaction (a victim must open the logo image in a new tab or visit a page rendering the logo). The PoC demonstrates uploading an SVG file with an alert(1) payload via a POST request to /invoiceplane/index.php/settings with the login_logo form field, after which right-clicking the logo and opening it in a new tab triggers script execution. The fix in version 1.7.1 blocks SVG files from being rendered as images and adds comprehensive input sanitization and output encoding across the application (GitHub Commit).

Successful exploitation enables an attacker with administrator access to inject persistent malicious scripts into the application, which execute in the browsers of any user who views the login page or the rendered logo. Consequences include unauthorized modification of application data, theft of session tokens or credentials, creation of persistent backdoors through stored scripts, addition of rogue administrator accounts, and full compromise of the application's integrity and confidentiality (GitHub Advisory, Feedly).

A proof-of-concept exploit is publicly available via the GitHub Security Advisory, demonstrating SVG upload with embedded JavaScript (GitHub Advisory). There is no evidence of active in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.031% (0.000310), indicating a low probability of exploitation in the near term (Feedly). This vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Authenticate as Administrator: Log in to the InvoicePlane 1.7.0 instance using valid administrator credentials.
2. Navigate to Logo Upload: Go to System Settings → General and locate the Login Logo upload field.
3. Craft Malicious SVG: Create an SVG file containing an embedded script payload, for example:

<svg xmlns="http://www.w3.org/2000/svg">
  <script>alert(document.cookie);</script>
</svg>

4. Upload the SVG: Submit the file via the login logo upload form (POST request to /invoiceplane/index.php/settings with login_logo as the form-data field name and the SVG as the file).
5. Trigger Execution: The malicious SVG is stored on the server. Any user (including non-admins) who right-clicks the logo and opens it in a new tab, or any page that renders the SVG inline, will trigger the embedded script in their browser context.
6. Achieve Objective: The executed script can steal session cookies, perform actions on behalf of the victim, or establish a persistent backdoor by modifying application settings (GitHub Advisory).

• Network: Unusual POST requests to /invoiceplane/index.php/settings uploading .svg files as the login_logo parameter; outbound connections from the server to unknown external hosts following logo upload events.
• File System: Presence of unexpected .svg files in the InvoicePlane uploads/logo directory containing <script> tags or JavaScript event handlers (e.g., onload, onerror); files named with incrementing suffixes (e.g., xss2.svg, xss3.svg) indicating repeated upload attempts.
• Logs: Web server access logs showing POST requests to the settings endpoint with SVG file uploads from administrator accounts; application logs recording SVG upload events flagged by the version 1.7.1 security logging feature.
• Browser/Application: Unexpected JavaScript alert dialogs or redirects appearing when the login page or logo is viewed; unexplained changes to administrator accounts or application settings (GitHub Advisory, GitHub Commit).

Upgrade InvoicePlane to version 1.7.1, which patches this vulnerability by blocking SVG files from being rendered as images, adding SVG upload logging, and implementing comprehensive input sanitization and output encoding across the application (GitHub Commit, GitHub Advisory). As interim workarounds, restrict administrator account access to trusted personnel only, implement server-side file type validation to reject SVG uploads, and enforce a strong Content Security Policy (CSP) to restrict inline script execution. Audit existing uploaded logo files for embedded scripts and remove any suspicious SVG files from the uploads directory.

The vulnerability was reported by security researcher Nguyen Truong Son and published as a GitHub Security Advisory by the InvoicePlane maintainer on February 16, 2026 (GitHub Advisory). Coverage has appeared on security aggregation sites including infinitsec.net and INCIBE-CERT, indicating moderate community awareness (Feedly). No significant broader media coverage or notable researcher commentary beyond the advisory has been identified.