CVE-2026-71233
Received Received - Intake

Stored XSS in InvoiceNinja Client Portal via Invoice Terms Field

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Description
InvoiceNinja v5-stable renders an invoice or quote's "terms" field in the client portal using Laravel Blade's raw output directive {!! $entity->terms !!} (resources/views/portal/ninja2020/invoices/includes/terms.blade.php) with no HTML sanitization. StoreInvoiceRequest.php only strips newlines from the field and does not purify HTML. An authenticated user with invoice creation access can set the terms field via the REST API (PUT /api/v1/invoices/{id}) to an HTML/JavaScript payload that executes in the client's browser when they view the invoice, enabling session cookie theft and client account takeover. This is a distinct code path from the previously published invoice line-item description field XSS (GHSA-98wm-cxpw-847p / CVE-2026-33628).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-71233
EUVD
EUVD-2026-53306

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
invoiceninja invoiceninja From 5.0.0 (inc)
invoiceninja invoiceninja 5-stable

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a cross-site scripting (XSS) vulnerability in InvoiceNinja v5-stable where the 'terms' field in invoices is rendered without HTML sanitization using Laravel Blade's raw output directive. An authenticated user with invoice creation rights can inject malicious HTML or JavaScript via the REST API, which executes when the invoice is viewed by others.

Detection Guidance

Check InvoiceNinja instances for unauthorized invoice terms modifications via API logs or database queries. Inspect client portal invoice views for unexpected JavaScript execution. Monitor network traffic for unusual outbound requests from client browsers.

Impact Analysis

An attacker could steal session cookies or take over client accounts by tricking users into viewing a malicious invoice. This could lead to unauthorized access to sensitive data, financial transactions, or further compromise of the system.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or health data, violating GDPR and HIPAA requirements for data protection and confidentiality. Organizations using InvoiceNinja may face compliance violations and potential legal consequences.

Mitigation Strategies

Update InvoiceNinja to the latest patched version immediately. Disable raw output rendering in invoice terms fields by replacing {!! $entity->terms !!} with {{ e($entity->terms) }} in the template file. Implement strict input validation for all API fields, especially terms.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-71233. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart