Executive brief
SolidInvoice, an open-source invoicing platform, contains a security flaw in its company logo upload feature. An administrator can upload a malicious image file containing hidden code that then runs in the browsers of all other users who visit the site. This could allow an attacker to steal session cookies, hijack accounts, or access sensitive financial data across the entire organization.
Technical details
SolidInvoice prior to version 2.3.17 is vulnerable to stored cross-site scripting (XSS) due to unrestricted file uploads in the company logo feature. The 'ImageUploadType' form component fails to validate MIME types or file extensions, allowing an authenticated administrator to upload SVG files containing embedded JavaScript. The application base64-encodes the file content and injects it unescaped into a data URI within a Twig template marked as 'is_safe'. Because the logo is rendered on nearly every page of the application, the malicious script executes in the context of any authenticated user's session. This allows for session hijacking and full account takeover. The issue is fixed in version 2.3.17 by implementing strict MIME type validation and excluding SVG support.
Affected products
- SolidInvoice SolidInvoice <= 2.3.16
Timeline
- 2026-05-15: patched: Fix committed to repository
- 2026-05-18: advisory: GitHub Security Advisory published
- 2026-06-11: disclosed: CVE published to NVD