High severity8.1NVD Advisory· Published Jun 11, 2026· Updated Jun 12, 2026

CVE-2026-46489

Description

SolidInvoice is an open-source invoicing platform. Prior to version 2.3.17, the company logo upload feature accepts any file type without validation. An authenticated administrator can upload an SVG file containing embedded JavaScript. This script is base64-encoded and injected unescaped into every page of the application, causing stored cross-site scripting (XSS) that executes in every authenticated user's browser. This issue has been patched in version 2.3.17.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Solidinvoice/Solidinvoicereferences2 versions
(expand)+ 1 more
- (no CPE)
- (no CPE)range: <2.3.17

Patches

Vulnerability mechanics

References

github.com/SolidInvoice/SolidInvoice/commit/8196c64df58b1226739f6ec4097fd6e7ba757860nvd
github.com/SolidInvoice/SolidInvoice/releases/tag/2.3.17nvd
github.com/SolidInvoice/SolidInvoice/security/advisories/GHSA-mqwm-r4g8-wf4wnvd

News mentions

No linked articles in our index yet.

cvss	0.526
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000