CVE-2026-78061
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
A vulnerability was determined in vas3k TaxHacker up to 0.8.2. The function buildImapConfig in lib/email-sync/imap-client.ts is vulnerable to server-side request forgery via manipulation of host/port arguments. The attack can be launched remotely. A pull request to fix this issue awaits acceptance.
Risk Assessment
An attacker can exploit SSRF to access internal network resources, potentially leading to data leakage or further attacks.
Recommendation
Monitor the pull request status and apply the fix when available, and restrict access to the service.
Other vulnerabilities in vas3k TaxHacker
See all- CVE-2026-94039High
A server-side request forgery vulnerability was detected in vas3k TaxHacker up to 0.8.5 in the generateInvoicePDF function of /apps/invoices/actions.ts in the Invoice PDF Renderer component. Manipulation of the businessLogo argument results in server-side request forgery, and the attack can be carried out remotely. The exploit is public and may be used, and the project has not responded to the issue report.
- CVE-2026-78062High
A vulnerability was identified in vas3k TaxHacker up to 0.8.2. The function envSchema.parse in lib/config.ts uses hard-coded credentials via the BETTER_AUTH_SECRET argument. The attack can be initiated remotely. The project was informed but has not responded.
Original NVD description (English source)
A vulnerability was determined in vas3k TaxHacker up to 0.8.2. Impacted is the function buildImapConfig of the file lib/email-sync/imap-client.ts of the component Email Sync. Executing a manipulation of the argument host/port can lead to server-side request forgery. It is possible to launch the attack remotely. The pull request to fix this issue awaits acceptance.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS