CVE-2026-34367
SSRF Vulnerability in InvoiceShelf PDF Generation Module
Publication date: 2026-03-31
Last updated on: 2026-04-09
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| invoiceshelf | invoiceshelf | to 2.2.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-918 | The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a Server-Side Request Forgery (SSRF) found in InvoiceShelf versions prior to 2.2.0. It occurs in the Invoice PDF generation module where user-supplied HTML in the invoice Notes field is passed without sanitization to the Dompdf rendering library. Because Dompdf fetches any remote resources referenced in the HTML markup, an attacker can exploit this by including malicious remote resource links. This can be triggered through the PDF preview and email delivery endpoints.
How can this vulnerability impact me? :
The SSRF vulnerability can allow an attacker to make the server perform unintended requests to internal or external systems. This can lead to unauthorized access to internal resources, data leakage, or interaction with internal services that are not normally exposed. Given the CVSS score of 7.6 with high confidentiality impact, it indicates that sensitive information could be disclosed, and the integrity of the system could be partially compromised.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability exists in InvoiceShelf versions prior to 2.2.0 due to unsanitised user-supplied HTML being passed to the Dompdf rendering library, which can fetch remote resources and lead to SSRF.
To mitigate this vulnerability immediately, upgrade InvoiceShelf to version 2.2.0 or later where the issue has been patched.