What is the CVSS score of CVE-2026-71233?

CVE-2026-71233 has a CVSS 3.1 base score of 8.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of InvoiceNinja are affected by CVE-2026-71233?

InvoiceNinja v5-stable contains a critical stored XSS vulnerability allowing users with invoice creation privileges to inject malicious code that executes in customer browsers, enabling session…

How to fix or mitigate CVE-2026-71233?

Within 24 hours: identify all InvoiceNinja v5-stable installations and audit users with invoice creation permissions; immediately restrict invoice creation access to essential personnel only using role-based access controls. Within 7 days: implement Web Application Firewall rules to block XSS patterns in invoice terms fields; audit all recent invoices for injected malicious content and review client portal access logs for compromise indicators. Within 30 days: implement server-side HTML sanitization using a library compatible with Laravel (e.g., HTML Purifier) to escape user input in invoice rendering; continuously monitor vendor advisories for security patches; establish incident response procedures and customer notification protocols in preparation for eventual patch deployment.

InvoiceNinja CVE-2026-71233

EUVD-2026-53306 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-08-05 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

GHSA-84j5-x242-f7h8

PHP XSS

8.7

CVSS 3.1 · Vendor: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Severity by source

Vendor (309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c) PRIMARY

8.7 HIGH

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

vuln.today AI

8.7 HIGH

PR:L for required invoice-creator credentials, UI:R for mandatory client interaction, S:C for cross-context session impact; no availability impact applies.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c).

CVSS VectorVendor: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 11:34 vuln.today

CVE Published

Aug 05, 2026 - 11:16 cve.org

HIGH 8.7

DescriptionCVE.org

InvoiceNinja v5-stable renders an invoice or quote's "terms" field in the client portal using Laravel Blade's raw output directive {!! $entity->terms !!} (resources/views/portal/ninja2020/invoices/includes/terms.blade.php) with no HTML sanitization. StoreInvoiceRequest.php only strips newlines from the field and does not purify HTML. An authenticated user with invoice creation access can set the terms field via the REST API (PUT /api/v1/invoices/{id}) to an HTML/JavaScript payload that executes in the client's browser when they view the invoice, enabling session cookie theft and client account takeover. This is a distinct code path from the previously published invoice line-item description field XSS (GHSA-98wm-cxpw-847p / CVE-2026-33628).

AnalysisAI

Stored XSS in InvoiceNinja v5-stable allows an authenticated user with invoice creation access to inject arbitrary JavaScript into the invoice terms field, which executes in a business client's browser when they view the invoice in the client portal. The attack leverages Laravel Blade's raw unescaped output directive in resources/views/portal/ninja2020/invoices/includes/terms.blade.php, with no HTML sanitization performed in StoreInvoiceRequest.php, enabling session cookie theft and full client account takeover. This is a distinct code path from the previously published CVE-2026-33628 (line-item description XSS), and no public exploit has been identified at time of analysis.

Technical ContextAI

InvoiceNinja is a PHP invoicing platform built on the Laravel framework. The root cause (CWE-79, Stored XSS) lies in the use of Laravel Blade's raw unescaped output directive {!! $entity->terms !!} in resources/views/portal/ninja2020/invoices/includes/terms.blade.php. The safe equivalent - {{ $entity->terms }} - auto-escapes HTML entities; the raw directive does not. Compounding this, StoreInvoiceRequest.php performs only newline stripping on the terms field before persistence, providing no HTML purification or allowlist-based sanitization. This means attacker-controlled markup stored in the database is written directly into the portal HTML response, satisfying the classic stored XSS pattern. The REST API endpoint PUT /api/v1/invoices/{id} is the write path. No CPE string was provided in the input data.

RemediationAI

The primary fix is to replace the raw Blade directive {!! $entity->terms !!} in resources/views/portal/ninja2020/invoices/includes/terms.blade.php with the auto-escaping {{ $entity->terms }}, or alternatively apply an HTML purification library (such as HTMLPurifier) in StoreInvoiceRequest.php before the terms value is persisted - the latter would also protect any other rendering contexts. Check https://github.com/invoiceninja/invoiceninja for a released patched version; no specific fix version was confirmed in the available data, so patch availability must be independently verified. As a compensating control, restrict invoice creation and editing permissions exclusively to fully trusted internal users, which reduces the attacker surface but does not eliminate the vulnerability. Deploying a strict Content-Security-Policy header on the client portal that disallows unsafe-inline scripts would substantially reduce XSS impact, though compatibility testing with portal JavaScript functionality is required. Note that this vulnerability is a distinct code path from CVE-2026-33628; patching one does not remediate the other.