CVE-2026-85293 Details
Description
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. In version 1.7.2-beta-1, InvoicePlane stores client_email values without enforcing email syntax and renders them unescaped inside double-quoted value attributes in the invoice mailer form and quote mailer form. An administrator who can edit a client can store attribute-breaking input, and, when the mailer is configured, JavaScript executes when another authenticated administrator opens the related mailer page. The script runs in the InvoicePlane origin and can perform same-origin actions with the victim's session. This issue is fixed in version 1.7.2.
A stored cross-site scripting vulnerability has been identified in InvoicePlane version 1.7.2-beta-1. The issue arises because the application does not properly validate email addresses entered in the 'client_email' field, allowing administrators to inject malicious JavaScript. This script is executed when another administrator accesses the invoice or quote mailer page associated with the client. The vulnerability takes advantage of the email field being rendered unescaped within double-quoted HTML attributes, which can be exploited to execute JavaScript in the context of the victim's session.
Users are advised to upgrade to InvoicePlane version 1.7.2, which addresses this vulnerability by escaping the 'client_email' field in the mailer views and adding validation to ensure proper email syntax.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 25, 2026CISA-ADP
Assessed Sep 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/InvoicePlane/InvoicePlane/security/advisories/GHSA-477r-xmgc-vcvj | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/InvoicePlane/InvoicePlane/commit/1e74c032ff1c65e6a4f9d173505f415c3a539f57 | [email protected] | Source CodeVendor |
| https://github.com/InvoicePlane/InvoicePlane/pull/1635 | [email protected] | Issue TrackingVendor |
| https://github.com/InvoicePlane/InvoicePlane/releases/tag/v1.7.2 | [email protected] | Release NotesVendor |
| https://github.com/InvoicePlane/InvoicePlane/security/advisories/GHSA-477r-xmgc-vcvj | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
| CWE-87 | Improper Neutralization of Alternate XSS Syntax | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| InvoicePlane | 1.7.2-beta-1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 25, 2026 | New CVE Received | [email protected] |
| Sep 25, 2026 | CVE Modified | CISA-ADP |