CVE-2026-55385

Deferred Deferred - Pending Action

Remote Code Execution in InvoiceShelf PDF Generation

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: GitHub, Inc.

Description

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf's PDFConfigurationRequest.php validates the owner-controlled gotenberg_host setting only as a syntactically valid URL. GotenbergPDFDriver::loadView later sends a multipart HTTP request containing rendered invoice, estimate, or payment HTML as document.html to that host without rejecting private, loopback, link-local, or reserved addresses. An owner can use PDF generation to reach internal services or cloud metadata endpoints, and a configured external host receives customer names, addresses, line items, totals, and company identifiers from subsequent PDF renders. This issue is fixed in version 2.4.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-55385

EUVD

EUVD-2026-101612

Affected Vendors & Products

Vendor	Product	Version / Range
InvoiceShelf	InvoiceShelf	< 2.4.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

This is a Server-Side Request Forgery (SSRF) vulnerability in InvoiceShelf versions before 2.4.0. It allows authenticated users to configure the Gotenberg PDF renderer host to point to internal services or cloud metadata endpoints. When PDF generation is triggered, the server sends rendered invoice HTML containing sensitive customer data to the specified host without blocking private or reserved IP addresses.

Detection Guidance

Check InvoiceShelf version with: grep -r "version" /path/to/InvoiceShelf/composer.json. If version is below 2.4.0, the system is vulnerable. Inspect network traffic for outbound POST requests to unexpected hosts during PDF generation. Review logs for requests to localhost, private IPs, or cloud metadata endpoints (e.g., 169.254.169.254).

Test by attempting to set gotenberg_host to a private IP via API and observe if PDF generation triggers an outbound request to that IP.

Impact Analysis

An attacker with Owner-level access could exfiltrate customer data like names, addresses, financial details, and company identifiers by sending it to an attacker-controlled server. They could also scan internal networks or access cloud metadata endpoints (AWS, GCP, Azure) to gather sensitive information.

Compliance Impact

This vulnerability likely violates GDPR and HIPAA due to unauthorized exposure of personal and financial data. GDPR requires protection of personal data, while HIPAA mandates safeguards for protected health information. The data exfiltration risk conflicts with both regulations' data security requirements.

Mitigation Strategies

Upgrade InvoiceShelf to version 2.4.0 or later immediately. If upgrading is not possible, restrict gotenberg_host to a trusted public host and disable Owner-level access to configuration settings until patched.

If using Docker Compose, set gotenberg_allow_private_host to the specific private host IP via GOTENBERG_ALLOWED_PRIVATE_HOST environment variable. Monitor network traffic for unexpected outbound requests to internal or reserved addresses.

Hi! I’m here to help you understand CVE-2026-55385. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70