Executive Summary

CVE-2026-46489 is a stored cross-site scripting (XSS) vulnerability in the SolidInvoice invoicing platform prior to version 2.3.17. The vulnerability occurs because the company logo upload feature accepts SVG files without validating their content. An authenticated administrator can upload an SVG file containing embedded JavaScript, which is base64-encoded and injected unescaped into every page of the application. This causes the malicious script to execute in the browsers of all authenticated users.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts including session hijacking, cross-site request forgery (CSRF) chain attacks, credential harvesting, and full account takeover for all users of the application. Since the malicious script executes in every authenticated user's browser, an attacker can steal session cookies and other sensitive information, potentially compromising the entire user base.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if an authenticated administrator has uploaded an SVG file containing embedded JavaScript as the company logo in SolidInvoice versions prior to 2.3.17.

Since the malicious SVG is stored in the settings table and rendered unescaped in every page, you can inspect the logo upload settings or database entries for SVG files containing suspicious base64-encoded JavaScript.

Commands to detect this might include querying the database for SVG files in the logo settings or searching web server logs for suspicious requests related to logo uploads.

• Use SQL queries to check the settings table for SVG content, e.g., `SELECT * FROM settings WHERE logo LIKE '%.svg%'`.
• Search for base64-encoded JavaScript patterns in the logo data, e.g., `grep -r 'base64' /path/to/solidinvoice/data`.
• Monitor web server logs for POST requests to the logo upload endpoint by authenticated administrators.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade SolidInvoice to version 2.3.17 or later, where the vulnerability has been patched.

This update includes validation of logo uploads to restrict file types to JPEG, PNG, GIF, and WebP, explicitly excluding SVG files to prevent embedded JavaScript execution.

If upgrading immediately is not possible, restrict administrator access to the logo upload feature and remove any existing SVG logos from the system.

Additionally, review and monitor for any suspicious activity related to logo uploads and consider applying manual validation or blocking of SVG uploads at the web server or application firewall level.

Useful 0 Not Useful 0