What is the CVSS score of CVE-2026-46489?

CVE-2026-46489 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of SolidInvoice are affected by CVE-2026-46489?

SolidInvoice versions prior to 2.3.17 contain a stored cross-site scripting vulnerability in the logo upload feature that allows authenticated administrators to inject malicious code executed in all…. A patch is available.

How to fix or mitigate CVE-2026-46489?

Within 24 hours: disable SVG logo uploads and restrict administrative access to essential personnel. Within 7 days: monitor SolidInvoice vendor advisories for patched version availability and prepare a test environment. Within 30 days: deploy patched version upon release, or maintain the following compensating controls indefinitely.

SolidInvoice CVE-2026-46489

EUVD-2026-36303 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-06-11 GitHub_M

XSS Solidinvoice

8.1

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Network-reachable admin upload (AV:N/AC:L/PR:H), victim must load a page (UI:R), payload executes in other users' browser context (S:C) compromising session confidentiality and integrity (C:H/I:H), no availability impact.

3.1 AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

Jun 11, 2026 - 21:02 EUVD

Source Code Evidence Fetched

Jun 11, 2026 - 20:22 vuln.today

Analysis Generated

Jun 11, 2026 - 20:22 vuln.today

DescriptionCVE.org

SolidInvoice is an open-source invoicing platform. Prior to version 2.3.17, the company logo upload feature accepts any file type without validation. An authenticated administrator can upload an SVG file containing embedded JavaScript. This script is base64-encoded and injected unescaped into every page of the application, causing stored cross-site scripting (XSS) that executes in every authenticated user's browser. This issue has been patched in version 2.3.17.

AnalysisAI

Stored cross-site scripting in SolidInvoice prior to 2.3.17 allows an authenticated administrator to upload a malicious SVG as the company logo, with the file's contents being base64-encoded and injected unescaped into every page of the application. The embedded JavaScript executes in every authenticated user's browser session, enabling session hijacking and privileged action abuse across the tenant. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

SolidInvoice is an open-source PHP/Symfony-based invoicing platform (CPE cpe:2.3:a:solidinvoice:solidinvoice). The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation): the logo upload handler performs no MIME or content-type validation, so SVG - an XML-based image format that natively supports <script> tags and event handlers - is accepted alongside raster image types. The uploaded file is then base64-encoded and emitted into the page template (likely as a data: URI or inline element) without contextual output escaping, so any JavaScript contained in the SVG is parsed and executed by the browser on every authenticated page load.

RemediationAI

Vendor-released patch: upgrade SolidInvoice to version 2.3.17 or later, which contains the fix at commit 8196c64df58b1226739f6ec4097fd6e7ba757860 and is published at https://github.com/SolidInvoice/SolidInvoice/releases/tag/2.3.17; review the advisory at https://github.com/SolidInvoice/SolidInvoice/security/advisories/GHSA-mqwm-r4g8-wf4w. Where immediate upgrade is not possible, remove or replace any logo currently configured by an untrusted admin, restrict the administrator role to a minimal set of trusted users, and consider blocking SVG uploads at a reverse proxy or WAF by rejecting Content-Type image/svg+xml and any uploaded file whose contents begin with <?xml or <svg on the logo upload endpoint - the trade-off is that legitimate SVG logos will no longer render and must be re-uploaded as PNG/JPEG. As an additional in-browser mitigation, enforce a strict Content-Security-Policy that disallows inline script execution and data: URIs in script contexts, accepting that this may break other inline scripts in the application until the patched version is deployed.