CVE-2026-34367: falha de alta gravidade em InvoiceShelf
InvoiceShelf: SSRF in Invoice PDF Rendering via Unsanitised HTML in Notes Field
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.6epss 0.3%
InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.2.0, a Server-Side Request Forgery (SSRF) vulnerability exists in the Invoice PDF generation module. User-supplied HTML in the invoice Notes field is passed unsanitised to the Dompdf rendering library, which will fetch any remote resources referenced in the markup. This can be triggered via the PDF preview and email delivery endpoints. This issue has been patched in version 2.2.0.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N
Produtos afetados
InvoiceShelf · InvoiceShelfCVEs relacionadas — InvoiceShelf
No mesmo produto, das mais perigosas para as menos.
CVE-2026-55385MEDIUMInvoiceShelf: SSRF via unvalidated Gotenberg PDF renderer host in PDF configurationEPSS 0.6%CVE-2026-55387HIGHInvoiceShelf bulk deletion lacks company scopingEPSS 0.4%CVE-2026-55610HIGHInvoiceShelf has cross-company user read/update IDOR that enables cross-tenant account takeoverEPSS 0.4%CVE-2026-55383HIGHInvoiceShelf: Public EmailLog token type confusion allows cross-company invoice disclosureEPSS 0.4%CVE-2026-55382HIGHInvoiceShelf: Cross-company read/modify/delete of notes via missing company scope in NotePolicy (BOLA/IDOR)EPSS 0.4%CVE-2026-55381HIGHInvoiceShelf: IDOR in InvoiceShelf estimate-to-invoice conversion allows any company user to read and tamper with other companies' estimatesEPSS 0.4%