CVE-2026-46489: SolidInvoice: Unrestricted file upload with no MIME validation allows stored XSS via malicious SVG logo

Synopsis

This is a stored cross-site scripting (XSS) vulnerability in SolidInvoice, an open-source invoicing platform. An authenticated administrator can upload a malicious SVG file as the company logo; because the application performs no file type or MIME validation, embedded JavaScript in the SVG is injected unescaped into every page and executes in the browser of every authenticated user who visits the application. Successful exploitation allows an attacker to run arbitrary JavaScript in victims' sessions, enabling credential theft, account takeover, or unauthorized actions on behalf of affected users. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the SolidInvoice web interface over the network to upload the malicious SVG file.

• AuthenticationRequired

  An administrator-level account is required; a low-privilege user cannot access the logo upload feature.

• Victim interactionRequired

  Victim users must load any page of the application in their browser for the injected JavaScript to execute, which happens automatically during normal authenticated use.

• Attack complexityDetail

  The exploit is reliable and condition-free once admin access is obtained; no race conditions or special environmental factors are needed.

Blast Radius

• Reads authenticated session tokens from any user who loads a page, enabling account takeover across the entire user base.
• Executes arbitrary JavaScript in the browser context of every authenticated user, allowing form submission, data exfiltration, or credential harvesting on their behalf.
• Modifies page content as rendered in victims' browsers, enabling phishing overlays or redirection to attacker-controlled sites.