CVE-2026-46489: SolidInvoice Stored XSS via Unvalidated Logo Upload

Technical summary

The vulnerability stems from insufficient file validation in SolidInvoice's logo upload endpoint. The application fails to validate the MIME type or file extension of uploaded files, allowing an administrator to upload an SVG image containing embedded JavaScript. Upon rendering, the SVG's JavaScript payload is base64-encoded and injected unescaped into the HTML of every application page. Because the injection occurs server-side and the payload is stored in the database, the XSS is stored (persistent) rather than reflected. The attack requires administrator privileges to upload the malicious file but affects all authenticated users without requiring additional user interaction beyond normal application usage. This maps to CWE-434 (unrestricted upload of file with dangerous type) and CWE-79 (improper neutralization of input during web page generation).

Business impact

A malicious or compromised administrator account can conduct persistent XSS attacks against all users of a SolidInvoice instance. Attack surface includes theft of session cookies, API tokens, and CSRF tokens; modification of invoices, customer records, and payment information; credential harvesting through fake login forms injected into legitimate pages; and lateral movement to connected systems if users reuse credentials. For organizations using SolidInvoice to manage financial records, this creates a path to financial fraud, data theft, and compliance violations (PCI DSS, SOC 2, GDPR depending on use case). The persistence of the payload means the attack continues until the malicious logo is removed and all browser caches are cleared.

Affected systems

SolidInvoice versions prior to 2.3.17 are affected. The vulnerability requires administrator access to trigger, so organizations with SolidInvoice instances must assess whether their administrator accounts are sufficiently protected (strong authentication, limited access, monitoring) and whether non-administrative users could be promoted to admin roles through other vulnerabilities or misconfigurations. Open-source deployments and self-hosted instances are the primary exposure vector.

Exploitability

Exploitation requires an authenticated administrator account with upload privileges, which significantly limits the attack surface compared to unauthenticated exploits. However, administrator credentials are a high-value target for attackers, and compromised admins are not uncommon in breach scenarios. Once uploaded, the payload executes automatically in all user sessions without requiring victim interaction, making it highly effective within that trust boundary. The barrier to exploitation is moderate (requires admin access) but the impact is severe (all users affected).

Remediation

Upgrade SolidInvoice to version 2.3.17 or later, which implements proper file type validation for uploaded logos. After patching, verify that no malicious SVG files remain in the application's uploads directory or database by auditing recent logo uploads, clearing browser caches across all user sessions, and reviewing administrator access logs for unauthorized changes. Organizations should also review who has been granted administrator privileges and enforce stronger authentication controls (MFA, IP whitelisting, audit logging) on admin accounts.

Patch guidance

Apply the upgrade to SolidInvoice 2.3.17 as soon as possible, prioritizing instances that manage sensitive financial or customer data. Test the patch in a non-production environment first to ensure compatibility with any custom extensions or integrations. After deployment, force a logout of all active sessions to clear any cached payloads and require users to re-authenticate. Verify the patch by attempting to upload an SVG file with embedded script tags; the application should reject it or sanitize it. Document the patch application date and confirm completion across all SolidInvoice deployments in your environment.

Detection guidance

Search application logs and file upload records for SVG files uploaded to the logo feature, particularly those with suspicious timestamps or unusual names. Examine the company logo file in the application's uploads directory and verify it is a valid, non-malicious SVG. Review administrator access logs for unauthorized login attempts or privilege escalations around the time the malicious logo was uploaded. Monitor browser console errors and network requests during user sessions for signs of injected JavaScript execution. Use a web application firewall (WAF) to block uploads with SVG MIME types to the logo endpoint if immediate patching is delayed. Forensically recover any deleted uploads to determine if malicious files were present and when they were removed.

Why prioritize this

This vulnerability scores HIGH (CVSS 8.1) because it enables persistent XSS affecting all users once deployed by an admin, with confidentiality and integrity impact. It is not on the KEV list, indicating it has not yet been exploited in the wild at scale, but the attack is straightforward once admin access is obtained. Organizations should patch urgently if their SolidInvoice instance is internet-facing or accessible to untrusted networks. The risk is proportional to the sensitivity of financial data managed and the number of users affected.

Risk score, explained

The CVSS 3.1 score of 8.1 reflects: network-based attack vector (AV:N), low attack complexity (AC:L), high privilege requirement limiting initial reach (PR:H), required user interaction (UI:R) in the form of normal page navigation, changed scope to other systems (S:C), and high impact on confidentiality and integrity (C:H, I:H) with no availability impact (A:N). The score appropriately penalizes the privilege requirement but recognizes that once a malicious logo is uploaded, the payload executes automatically across the entire user base, making containment difficult without patch and cache clearing.

Frequently asked questions