CVE-2026-55386: falha de alta gravidade em InvoiceShelf
InvoiceShelf ORDER BY SQL injection through orderByField
Publicada em
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.1epss 0.4%
probabilidade de exploração
0.4%top 71% das CVEs
exploração observada
nãonenhuma fonte reporta
InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf passes the authenticated user's orderByField query parameter into Laravel orderBy calls in Invoice::scopeApplyFilters without restricting the value to column identifiers. A crafted SQL expression can therefore enter the ORDER BY clause across invoice and other list endpoints, enabling boolean-based blind extraction of database information. This issue is fixed in version 2.4.0.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
InvoiceShelf · InvoiceShelfCVEs relacionadas — InvoiceShelf
No mesmo produto, das mais perigosas para as menos.
CVE-2026-55385MEDIUMInvoiceShelf: SSRF via unvalidated Gotenberg PDF renderer host in PDF configurationEPSS 0.5%CVE-2026-55383HIGHInvoiceShelf: Public EmailLog token type confusion allows cross-company invoice disclosureEPSS 0.4%CVE-2026-34367HIGHInvoiceShelf: SSRF in Invoice PDF Rendering via Unsanitised HTML in Notes FieldEPSS 0.4%CVE-2026-55382HIGHInvoiceShelf: Cross-company read/modify/delete of notes via missing company scope in NotePolicy (BOLA/IDOR)EPSS 0.4%CVE-2026-34366HIGHInvoiceShelf: SSRF in Payment Receipt PDF Rendering via Unsanitised HTML in Notes FieldEPSS 0.4%CVE-2026-34365HIGHInvoiceShelf: SSRF in Estimate PDF Rendering via Unsanitised HTML in Notes FieldEPSS 0.4%
Referências
https://github.com/InvoiceShelf/InvoiceShelf/commit/e92b08ef6af7d0d0cd5183df81f795f7fbf4f4fchttps://github.com/InvoiceShelf/InvoiceShelf/pull/663https://github.com/InvoiceShelf/InvoiceShelf/releases/tag/2.4.0https://github.com/InvoiceShelf/InvoiceShelf/security/advisories/GHSA-cp8p-jcqf-j39c