CVE-2026-25595: 
NixOS vulnerability analysis and mitigation

CVE-2026-25595 is a Stored Cross-Site Scripting (XSS) vulnerability in InvoicePlane, a self-hosted open source invoicing application. The flaw exists in InvoicePlane version 1.7.0 (and likely prior versions) via the Invoice Number field, which is rendered without HTML encoding in multiple views. An authenticated administrator can inject malicious JavaScript that persists in the system and executes when any administrator views the affected invoice or visits the dashboard. The vulnerability was published on February 18, 2026, and carries a CVSS v3.1 base score of 4.8 (Medium) (GitHub Advisory, Red Hat CVE).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), where the invoice_number field is stored and subsequently rendered without HTML encoding in at least three locations: application/modules/invoices/views/view.php (lines 247 and 494) and application/modules/dashboard/views/index.php (line 233). An authenticated administrator can set the Invoice Number to a malicious JavaScript payload (e.g., <script>alert(1)</script>) via the invoice creation/edit form at /index.php/invoices/form/{id}. The payload is then persistently stored and executes in the browser of any administrator who views the invoice at /index.php/invoices/view/{id} or visits the dashboard at /index.php/dashboard (GitHub Advisory).

Successful exploitation allows malicious scripts to execute in the context of other administrators' browser sessions, enabling session token theft, unauthorized actions performed on behalf of administrators, and access to sensitive client, invoice, and payment data within InvoicePlane. The dashboard trigger is particularly impactful because all administrators visit it regularly, maximizing the likelihood of script execution. While the attack requires administrator-level privileges to inject the payload (admin-to-admin attack), the scope change (S:C in CVSS) indicates the impact extends beyond the attacker's own session (GitHub Advisory, Feedly).

A proof-of-concept (PoC) is publicly available in the GitHub Security Advisory, demonstrating the exploit with a simple <script>alert(1)</script> payload in the Invoice Number field. There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.009% (0.000090), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, Feedly).

1. Authenticate as Administrator: Log in to the InvoicePlane instance with administrator credentials.
2. Navigate to Invoice Form: Go to /index.php/invoices/form/{id} to create a new invoice or edit an existing one.
3. Inject XSS Payload: Set the Invoice Number field to a malicious JavaScript payload, such as <script>alert(document.cookie)</script> or a more sophisticated payload to exfiltrate session tokens to an attacker-controlled server.
4. Save the Invoice: Submit the form to persist the malicious payload in the database.
5. Trigger Execution: The injected script executes automatically when any administrator views the affected invoice at /index.php/invoices/view/{id} or visits the dashboard at /index.php/dashboard, delivering the attacker's payload in the victim's browser context (GitHub Advisory).

• Logs: Web server access logs showing POST requests to /index.php/invoices/form/{id} with unusual or encoded content in the invoice_number parameter; access log entries showing script tags or JavaScript keywords in request bodies.
• Application Data: Invoice records in the database where the invoice_number field contains HTML tags, JavaScript (<script>, onerror=, javascript:, etc.), or encoded variants thereof.
• Network: Unexpected outbound HTTP requests from administrator browsers to external domains shortly after visiting /index.php/invoices/view/{id} or /index.php/dashboard, potentially carrying session cookie data.
• Browser: Unexpected JavaScript alerts, redirects, or network requests triggered when administrators load invoice or dashboard pages (GitHub Advisory).

Upgrade InvoicePlane to version 1.7.1, which patches this vulnerability by adding HTML encoding (htmlsc()) to the invoice_number field in all affected views and implementing backend input sanitization (GitHub Commit). Until patching is complete, restrict administrative access to only trusted users, monitor invoice creation activities, and review existing invoice records for suspicious content in the Invoice Number field. No configuration-only workaround is available that fully mitigates the vulnerability (GitHub Advisory).

The vulnerability was reported by security researcher lagathos and published by InvoicePlane maintainer nielsdrost7 via a GitHub Security Advisory on February 16, 2026. Coverage has been picked up by vulnerability aggregators including INCIBE-CERT, VulnDB, and Vulners, as well as security blog infinitsec.net. No significant broader media coverage or notable community debate has been observed beyond standard vulnerability disclosure channels (GitHub Advisory, infinitsec.net).