CVE-2026-85293

Deferred Deferred - Pending Action

Stored XSS in InvoicePlane via Unsanitized Client Email

Publication date: 2026-09-25

Last updated on: 2026-09-28

Assigner: GitHub, Inc.

Description

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. In version 1.7.2-beta-1, InvoicePlane stores client_email values without enforcing email syntax and renders them unescaped inside double-quoted value attributes in the invoice mailer form and quote mailer form. An administrator who can edit a client can store attribute-breaking input, and, when the mailer is configured, JavaScript executes when another authenticated administrator opens the related mailer page. The script runs in the InvoicePlane origin and can perform same-origin actions with the victim's session. This issue is fixed in version 1.7.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-09-28

Generated

2026-10-16

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-85293

EUVD

EUVD-2026-87128

Affected Vendors & Products

Vendor	Product	Version / Range
invoiceplane	invoiceplane	to 1.7.2 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-87	The product does not neutralize or incorrectly neutralizes user-controlled input for alternate script syntax.
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

InvoicePlane 1.7.2-beta-1 allows stored XSS via client_email in the invoice and quote mailer forms. An admin can inject malicious JavaScript by editing a client's email field without proper validation. When another admin views the mailer page, the script executes in the InvoicePlane origin and can perform actions using the victim's session.

Detection Guidance

Check InvoicePlane version for 1.7.2-beta-1. Inspect client_email fields in the database for malformed email values. Review mailer forms for unescaped client_email rendering in invoice and quote mailer pages.

Impact Analysis

An attacker with admin access could steal session cookies, perform unauthorized actions, or escalate privileges. The impact is limited to authenticated administrators viewing affected pages. The CVSS score indicates moderate severity with low integrity and confidentiality impact.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized JavaScript execution in the context of an authenticated administrator's session. This may lead to data breaches, unauthorized access to sensitive client information, or manipulation of invoice data, which are critical concerns under both regulations.

Mitigation Strategies

Upgrade InvoicePlane to version 1.7.2 or later immediately. Review and sanitize all client_email values in the database. Disable mailer functionality until upgrade is complete.

Hi! I’m here to help you understand CVE-2026-85293. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70