SolidInvoice's logo upload accepts files without MIME validation, allowing an administrator to upload an SVG containing base64‑encoded JavaScript. Because the content is injected unescaped into every rendered page for authenticated users, the flaw results in stored cross‑site scripting that executes across the entire user base. An attacker can steal session cookies, hijack accounts, and launch further attacks against other users.

All versions of SolidInvoice prior to 2.3.17, notably SolidInvoice 2.3.x and earlier releases. The vulnerability is fixed in 2.3.17 and later.

The CVSS score of 8.1 indicates high impact, and the flaw is available to any authenticated administrator, which is a common role in invoicing environments. Because no remote exploitation path is required, the attack surface is limited to compromised or privileged accounts. While the EPSS score is not available, the absence of a KEV listing does not diminish the high risk profile, and administrators should assume immediate patching is required.