CVE-2026-34366
HighCVSS 7.6Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
InvoiceShelf before version 2.2.0 has an SSRF vulnerability in the PDF receipt generation module. User-supplied HTML in the Notes field is passed unsanitized to Dompdf, which fetches remote resources, enabling SSRF attacks.
Risk Assessment
An attacker can use the server to scan internal networks, read files, or attack other systems, potentially leading to data leakage or further compromise.
Recommendation
Upgrade InvoiceShelf to version 2.2.0 or later.
Other vulnerabilities in InvoiceShelf
See all- CVE-2026-34367High
InvoiceShelf prior to version 2.2.0 has an SSRF vulnerability in the PDF generation module. User-supplied HTML in the Notes field is passed unsanitized to the Dompdf library, which fetches remote resources, exploitable via PDF preview and email delivery endpoints.
- CVE-2026-34365High
InvoiceShelf before version 2.2.0 has an SSRF vulnerability in the PDF estimate generation module. User-supplied HTML in the Notes field is passed unsanitized to Dompdf, which fetches remote resources, enabling SSRF attacks.
Original NVD description (English source)
InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.2.0, a Server-Side Request Forgery (SSRF) vulnerability exists in the Payment receipt PDF generation module. User-supplied HTML in the payment Notes field is passed unsanitised to the Dompdf rendering library, which will fetch any remote resources referenced in the markup. The vulnerability is exploitable directly via the PDF receipt endpoint, regardless of whether automated email attachments are enabled. This issue has been patched in version 2.2.0.