InvoicePlane 1.7.0 permits administrators to upload SVG files as the login logo; an attacker can embed malicious SVG containing script, which is then rendered and stored in the system. When any user accesses the site, the malicious code executes under the user's browser context, enabling the attacker to modify application data, create persistent backdoors, or otherwise compromise the application's integrity. This vulnerability aligns with CWE‑79, representing a stored XSS flaw.

The affected product is the self‑hosted open‑source InvoicePlane application, specifically version 1.7.0. Version 1.7.1 includes a patch that resolves the issue. No other versions are listed as affected.

The CVSS score of 5.7 reflects moderate impact, while the EPSS score of less than 1% indicates a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires administrator privileges to upload a malicious SVG; once stored, the script runs for all users, making the attack vector administrative and file‑upload based rather than public network accessible.