InvoicePlane logo upload vulnerable to malicious SVG files

Summary

InvoicePlane, a self-hosted invoicing app, has a security flaw that allows hackers to upload malicious code, potentially altering data or taking control of the application. To fix, update to the latest version, 1.7.1. This vulnerability is particularly concerning because it requires admin rights to exploit, making it a serious issue even if an attacker needs to gain access first.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software

Vendor	Product	Affected versions	Fix available
invoiceplane	invoiceplane	1.7.0	–

Original title

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting (XSS) vulnerability occurs in the upload Invoice Logo functions of ...

Original description

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting (XSS) vulnerability occurs in the upload Invoice Logo functions of InvoicePlane version 1.7.0. The Upload Invoice Logo function allows the application to upload svg files. Although administrator privileges are required to exploit it, this is still considered a critical vulnerability as it can cause actions such as unauthorized modification of application data, creation of persistent backdoors through stored malicious scripts, and full compromise of the application's integrity. Version 1.7.1 patches the issue.

nvd CVSS3.1 7.5

Vulnerability type

CWE-79 Cross-site Scripting (XSS)

https://github.com/InvoicePlane/InvoicePlane/commit/93622f2df88a860d89bfee56012c... Patch
https://github.com/InvoicePlane/InvoicePlane/security/advisories/GHSA-485m-4725-... Exploit Mitigation Vendor Advisory