CVE-2026-24746: 
NixOS vulnerability analysis and mitigation

CVE-2026-24746 is a Stored Cross-Site Scripting (XSS) vulnerability in InvoicePlane version 1.7.0, affecting the Edit Quotes function where the application fails to validate user input in the quote_number parameter. Discovered by security researcher Nguyen Truong Son (truongson526@gmail.com) on January 24, 2026, and publicly disclosed via a GitHub Security Advisory on February 16, 2026. The vulnerability is classified as CWE-79 and carries a CVSS v3.1 base score of 7.5 (High) per Feedly/NVD, though the GitHub advisory rates it 5.7 (Moderate) with a slightly different vector (GitHub Advisory, Red Hat CVE). Version 1.7.1 patches the issue.

The root cause is improper neutralization of user-controlled input (CWE-79) in the Edit Quotes module of InvoicePlane 1.7.0. Specifically, the quote_number parameter submitted via a POST request to /invoiceplane/index.php/quotes/ajax/save is stored without server-side validation or output encoding, allowing malicious script content to persist in the application database and execute in victims' browsers when the quote is viewed. Exploitation requires an authenticated administrator account and user interaction (a victim must view the affected quote), but once injected, the payload executes persistently for any user who loads the page. The fix in version 1.7.1 introduced comprehensive output encoding using htmlsc() and backend input sanitization across quote/invoice number fields (GitHub Advisory, GitHub Commit).

Successful exploitation enables an attacker with administrator credentials to inject persistent malicious scripts into the application, which execute in the browsers of any user who views the affected quote. Potential consequences include unauthorized modification of application data, session hijacking, creation of persistent backdoors via stored scripts, addition of rogue administrator accounts, and full compromise of the application's integrity. While confidentiality impact is rated low (limited data exposure), integrity impact is rated high, reflecting the ability to persistently alter application behavior and data (GitHub Advisory).

A proof-of-concept payload is publicly documented in the GitHub Security Advisory: entering "><img src=x onerror=alert(1)> (or similar XSS payload) into the Quote # field and saving triggers an alert dialog, confirming exploitability. However, there is no evidence of active in-the-wild exploitation or inclusion in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is 0.0001 (very low probability of exploitation in the near term), and no threat actor attribution has been reported (GitHub Advisory, Red Hat CVE).

1. Authenticate as Administrator: Log in to the InvoicePlane 1.7.0 instance using valid administrator credentials.
2. Navigate to Edit Quotes: Access the Quotes module and open an existing quote for editing, or create a new quote.
3. Inject XSS Payload: In the Quote # (quote_number) field, enter a malicious payload such as "><img src=x onerror=alert(document.cookie)> or a more sophisticated payload to exfiltrate session tokens.
4. Save the Quote: Submit the form, which sends a POST request to /invoiceplane/index.php/quotes/ajax/save with the malicious quote_number value stored in the database without sanitization.
5. Trigger Execution: When any user (including other administrators or clients) views the affected quote, the stored script executes in their browser context, enabling session hijacking, credential theft, or further malicious actions (GitHub Advisory).

• Network: Unusual POST requests to /invoiceplane/index.php/quotes/ajax/save containing HTML/JavaScript special characters (<, >, ", script, onerror, alert) in the quote_number parameter.
• Logs: Web server access logs showing POST requests to the quotes save endpoint with encoded or raw XSS payloads in request bodies; application logs flagging XSS sanitization events (if logging is enabled in version 1.7.1+).
• Application Data: Quote records in the database where the quote_number field contains HTML tags, JavaScript event handlers, or script content rather than expected alphanumeric invoice number formats.
• Browser/Client Side: Unexpected JavaScript alert dialogs or network requests to external domains triggered when viewing quote pages, indicating stored script execution.

The primary remediation is to upgrade InvoicePlane to version 1.7.1, which introduces comprehensive output encoding (htmlsc()) for quote/invoice number fields and backend input sanitization across the application (GitHub Commit, GitHub Advisory). As interim mitigations, restrict administrative access to trusted personnel only, implement a Web Application Firewall (WAF) to detect and block XSS payloads in request parameters, and enforce a strong Content Security Policy (CSP) to limit inline script execution. There is no official configuration-based workaround for version 1.7.0 short of upgrading.

The vulnerability was reported by independent security researcher Nguyen Truong Son and acknowledged by the InvoicePlane maintainers, who published the GitHub Security Advisory and released the patch in version 1.7.1. Coverage has been limited to vulnerability aggregator sites (VulnDB, CVEFeed, Vulners) and a brief write-up on infinitsec.net, reflecting the niche scope of the affected self-hosted application (GitHub Advisory).