CVE-2026-71233

Name of the Vulnerable Software and Affected Versions InvoiceNinja version 5-stable

Description An authenticated user with invoice creation permissions can inject HTML or JavaScript payloads into the terms field of an invoice or quote. This occurs because the application renders this field in the client portal using a raw output directive without HTML sanitization. The StoreInvoiceRequest.php file only removes newlines and does not purify the HTML content. An attacker can exploit this by using the 'PUT /api/v1/invoices/{id}' API endpoint to set the terms variable, leading to script execution in the client's browser, which may result in session cookie theft and account takeover.

Recommendations As a temporary mitigation, restrict access to the 'PUT /api/v1/invoices/{id}' API endpoint or avoid using the terms parameter until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.