CVE-2026-55386: fallo de gravedad alta en InvoiceShelf
InvoiceShelf ORDER BY SQL injection through orderByField
Publicada el
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 7.1epss 0.4%
probabilidad de explotación
0.4%top 71% de las CVE
explotación observada
noninguna fuente lo reporta
InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf passes the authenticated user's orderByField query parameter into Laravel orderBy calls in Invoice::scopeApplyFilters without restricting the value to column identifiers. A crafted SQL expression can therefore enter the ORDER BY clause across invoice and other list endpoints, enabling boolean-based blind extraction of database information. This issue is fixed in version 2.4.0.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Productos afectados
InvoiceShelf · InvoiceShelfCVEs relacionadas — InvoiceShelf
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-55385MEDIUMInvoiceShelf: SSRF via unvalidated Gotenberg PDF renderer host in PDF configurationEPSS 0.5%CVE-2026-55383HIGHInvoiceShelf: Public EmailLog token type confusion allows cross-company invoice disclosureEPSS 0.4%CVE-2026-34367HIGHInvoiceShelf: SSRF in Invoice PDF Rendering via Unsanitised HTML in Notes FieldEPSS 0.4%CVE-2026-55382HIGHInvoiceShelf: Cross-company read/modify/delete of notes via missing company scope in NotePolicy (BOLA/IDOR)EPSS 0.4%CVE-2026-34366HIGHInvoiceShelf: SSRF in Payment Receipt PDF Rendering via Unsanitised HTML in Notes FieldEPSS 0.4%CVE-2026-34365HIGHInvoiceShelf: SSRF in Estimate PDF Rendering via Unsanitised HTML in Notes FieldEPSS 0.4%
Referencias
https://github.com/InvoiceShelf/InvoiceShelf/commit/e92b08ef6af7d0d0cd5183df81f795f7fbf4f4fchttps://github.com/InvoiceShelf/InvoiceShelf/pull/663https://github.com/InvoiceShelf/InvoiceShelf/releases/tag/2.4.0https://github.com/InvoiceShelf/InvoiceShelf/security/advisories/GHSA-cp8p-jcqf-j39c