CVEvulnerability

CVE-2026-34367

8.7 HIGH Published 2026-03-31 Modified 2026-07-24 Official page ↗
Status
Analyzed
Published
2026-03-31
Last modified
2026-07-24
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.6 HIGH — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N
CVSS 3.1 ([email protected])
8.7 HIGH — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
Weaknesses
CWE-918

Description

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.2.0, a Server-Side Request Forgery (SSRF) vulnerability exists in the Invoice PDF generation module. User-supplied HTML in the invoice Notes field is passed unsanitised to the Dompdf rendering library, which will fetch any remote resources referenced in the markup. This can be triggered via the PDF preview and email delivery endpoints. This issue has been patched in version 2.2.0.

Affected configurations

• invoiceshelf invoiceshelf (< 2.2.0)

Related

Weakness · CWE (1)

  • CWE-918 Server-Side Request Forgery weakness

References