CVE-2026-34366: fallo de gravedad alta en InvoiceShelf
InvoiceShelf: SSRF in Payment Receipt PDF Rendering via Unsanitised HTML in Notes Field
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 7.6epss 0.2%
InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.2.0, a Server-Side Request Forgery (SSRF) vulnerability exists in the Payment receipt PDF generation module. User-supplied HTML in the payment Notes field is passed unsanitised to the Dompdf rendering library, which will fetch any remote resources referenced in the markup. The vulnerability is exploitable directly via the PDF receipt endpoint, regardless of whether automated email attachments are enabled. This issue has been patched in version 2.2.0.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N
Productos afectados
InvoiceShelf · InvoiceShelfCVEs relacionadas — InvoiceShelf
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-55385MEDIUMInvoiceShelf: SSRF via unvalidated Gotenberg PDF renderer host in PDF configurationEPSS 0.6%CVE-2026-55387HIGHInvoiceShelf bulk deletion lacks company scopingEPSS 0.4%CVE-2026-55610HIGHInvoiceShelf has cross-company user read/update IDOR that enables cross-tenant account takeoverEPSS 0.4%CVE-2026-55383HIGHInvoiceShelf: Public EmailLog token type confusion allows cross-company invoice disclosureEPSS 0.4%CVE-2026-55382HIGHInvoiceShelf: Cross-company read/modify/delete of notes via missing company scope in NotePolicy (BOLA/IDOR)EPSS 0.4%CVE-2026-55381HIGHInvoiceShelf: IDOR in InvoiceShelf estimate-to-invoice conversion allows any company user to read and tamper with other companies' estimatesEPSS 0.4%