CVE-2026-71233

Received Received - Intake

Stored XSS in InvoiceNinja Client Portal via Invoice Terms Field

Publication date: 2026-08-05

Last updated on: 2026-08-10

Assigner: TuranSec

Description

InvoiceNinja v5-stable renders an invoice or quote's "terms" field in the client portal using Laravel Blade's raw output directive {!! ->terms !!} (resources/views/portal/ninja2020/invoices/includes/terms.blade.php) with no HTML sanitization.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-05

Last Modified

2026-08-10

Generated

2026-08-25

AI Q&A

2026-08-05

EPSS Evaluated

2026-08-24

NVD

CVE-2026-71233

EUVD

EUVD-2026-53306

Affected Vendors & Products

Vendor	Product	Version / Range
invoiceninja	invoiceninja	From 5.0.0 (inc)
invoiceninja	invoiceninja	5-stable

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a cross-site scripting (XSS) vulnerability in InvoiceNinja v5-stable where the 'terms' field in invoices is rendered without HTML sanitization using Laravel Blade's raw output directive. An authenticated user with invoice creation rights can inject malicious HTML or JavaScript via the REST API, which executes when the invoice is viewed by others.

Detection Guidance

Check InvoiceNinja instances for unauthorized invoice terms modifications via API logs or database queries. Inspect client portal invoice views for unexpected JavaScript execution. Monitor network traffic for unusual outbound requests from client browsers.

Impact Analysis

An attacker could steal session cookies or take over client accounts by tricking users into viewing a malicious invoice. This could lead to unauthorized access to sensitive data, financial transactions, or further compromise of the system.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or health data, violating GDPR and HIPAA requirements for data protection and confidentiality. Organizations using InvoiceNinja may face compliance violations and potential legal consequences.

Mitigation Strategies

Update InvoiceNinja to the latest patched version immediately. Disable raw output rendering in invoice terms fields by replacing {!! $entity->terms !!} with {{ e($entity->terms) }} in the template file. Implement strict input validation for all API fields, especially terms.

Hi! I’m here to help you understand CVE-2026-71233. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70