CVE-2026-55385
InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create…
- Risk score
- 50/100
- CVSS
- 6.8 v3.1
- Exploit chance (30 days)
- 0.6%
- Published
- 14 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf's PDFConfigurationRequest.php validates the owner-controlled gotenberg_host setting only as a syntactically valid URL. GotenbergPDFDriver::loadView la…
- Affected
- See advisory
- Fix
- Upgrade the product to 2.4.0 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 6.8 medium
References
- https://github.com/InvoiceShelf/InvoiceShelf/commit/d615cfb4ff4841a3b8cda7fc850a2bb335521fe5
- https://github.com/InvoiceShelf/InvoiceShelf/pull/664
- https://github.com/InvoiceShelf/InvoiceShelf/releases/tag/2.4.0
- https://github.com/InvoiceShelf/InvoiceShelf/security/advisories/GHSA-mfxg-qphw-3f3g
- https://github.com/InvoiceShelf/InvoiceShelf/security/advisories/GHSA-mfxg-qphw-3f3g
Original description
InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf's PDFConfigurationRequest.php validates the owner-controlled gotenberg_host setting only as a syntactically valid URL. GotenbergPDFDriver::loadView later sends a multipart HTTP request containing rendered invoice, estimate, or payment HTML as document.html to that host without rejecting private, loopback, link-local, or reserved addresses. An owner can use PDF generation to reach internal services or cloud metadata endpoints, and a configured external host receives customer names, addresses, line items, totals, and company identifiers from subsequent PDF renders. This issue is fixed in version 2.4.0.
Last activity 14 Oct 2026. Patch Forecast updates every hour.