CVE-2026-83744
Received Received - Intake

Server-Side Request Forgery in Invoice Ninja

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: VulDB

Description
A security vulnerability has been detected in invoiceninja Invoice Ninja up to 5.13.26. This vulnerability affects the function Purify::isHostSafe of the file app/Services/Pdf/Purify.php of the component invoices Endpoint. The manipulation of the argument notes leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-01
Last Modified
2026-09-01
Generated
2026-09-01
AI Q&A
2026-09-01
EPSS Evaluated
N/A
NVD
CVE-2026-83744
EUVD
EUVD-2026-68982

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
invoiceninja invoice_ninja to 5.13.26 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Server-Side Request Forgery (SSRF) vulnerability in Invoice Ninja versions up to 5.13.26. It occurs in the PDF rendering function Purify::isHostSafe where insufficient validation of external URLs in rich text content allows attackers to manipulate the notes argument to initiate unauthorized server-side requests. The flaw stems from hostname validation that checks strings but not resolved IP addresses, enabling bypass of blacklist filters.

Detection Guidance

Monitor outbound requests from your Invoice Ninja server during PDF generation. Use network traffic analysis tools like tcpdump or Wireshark to capture requests initiated by the headless browser during PDF rendering. Check for unexpected connections to internal IP ranges (RFC1918), loopback addresses, or cloud metadata endpoints. Enable detailed logging in your web server and application logs to track requests made during PDF generation.

Impact Analysis

An attacker could exploit this to make the server fetch resources from internal or restricted networks, enabling internal network reconnaissance, access to cloud metadata services, interaction with internal admin interfaces, or discovery of otherwise unreachable services. Exploitation requires an authenticated user with invoice editing permissions to modify notes containing malicious HTML references.

Compliance Impact

This SSRF vulnerability could lead to unauthorized access to internal systems, potentially exposing sensitive data such as personal or health information. This may violate GDPR's data protection requirements and HIPAA's safeguards for protected health information if exploited.

Mitigation Strategies

Upgrade to the latest version of Invoice Ninja if available. Implement strict hostname resolution by validating IP addresses instead of just hostnames. Block outbound requests to private IP ranges, loopback addresses, and cloud metadata endpoints. Disable external resource loading during PDF generation. Consider implementing a strict outbound allowlist for allowed domains.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-83744. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart