CVE-2026-55386highCWE-89

CVE-2026-55386: high-severity vulnerability in InvoiceShelf

InvoiceShelf ORDER BY SQL injection through orderByField

Published

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.1epss 0.4%
exploitation probability
0.4%top 71% of all CVEs
observed exploitation
nono source reports it
InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf passes the authenticated user's orderByField query parameter into Laravel orderBy calls in Invoice::scopeApplyFilters without restricting the value to column identifiers. A crafted SQL expression can therefore enter the ORDER BY clause across invoice and other list endpoints, enabling boolean-based blind extraction of database information. This issue is fixed in version 2.4.0.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
InvoiceShelf · InvoiceShelf
Related CVEs — InvoiceShelf

In the same product, most dangerous first.

CVE-2026-55385MEDIUMInvoiceShelf: SSRF via unvalidated Gotenberg PDF renderer host in PDF configurationEPSS 0.5%CVE-2026-55383HIGHInvoiceShelf: Public EmailLog token type confusion allows cross-company invoice disclosureEPSS 0.4%CVE-2026-34367HIGHInvoiceShelf: SSRF in Invoice PDF Rendering via Unsanitised HTML in Notes FieldEPSS 0.4%CVE-2026-55382HIGHInvoiceShelf: Cross-company read/modify/delete of notes via missing company scope in NotePolicy (BOLA/IDOR)EPSS 0.4%CVE-2026-34366HIGHInvoiceShelf: SSRF in Payment Receipt PDF Rendering via Unsanitised HTML in Notes FieldEPSS 0.4%CVE-2026-34365HIGHInvoiceShelf: SSRF in Estimate PDF Rendering via Unsanitised HTML in Notes FieldEPSS 0.4%
References
https://github.com/InvoiceShelf/InvoiceShelf/commit/e92b08ef6af7d0d0cd5183df81f795f7fbf4f4fchttps://github.com/InvoiceShelf/InvoiceShelf/pull/663https://github.com/InvoiceShelf/InvoiceShelf/releases/tag/2.4.0https://github.com/InvoiceShelf/InvoiceShelf/security/advisories/GHSA-cp8p-jcqf-j39c