InvoicePlane version 1.7.0 contains a stored cross‑site scripting flaw in the invoice logo upload function; the application accepts uploaded SVG files that can embed JavaScript. An attacker with administrative privileges can upload a malicious SVG, cause the embedded script to run in authenticated users’ browsers, and thereby manipulate application data or establish persistent backdoors.

The vulnerability affects the InvoicePlane application, specifically version 1.7.0. The vendor has released version 1.7.1 to patch the issue.

The CVSS score of 5.7 indicates medium severity, and the EPSS score of less than 1 % suggests a very low current exploitation probability. The vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog, so no active exploitation campaign is confirmed. Attackers must be authenticated administrators to exploit the flaw, which limits the attack surface but still allows them to run arbitrary JavaScript in the context of any logged‑in user, giving them the ability to modify data or implant persistent malicious code.