CVE-2026-94039
HighCVSS 7.3Summary
A server-side request forgery vulnerability was detected in vas3k TaxHacker up to 0.8.5 in the generateInvoicePDF function of /apps/invoices/actions.ts in the Invoice PDF Renderer component. Manipulation of the businessLogo argument results in server-side request forgery, and the attack can be carried out remotely. The exploit is public and may be used, and the project has not responded to the issue report.
Risk Assessment
An attacker could force the server to make requests to arbitrary internal or external resources, potentially leading to information disclosure or interaction with internal services. Public availability of the exploit increases the risk of exploitation.
Recommendation
Restrict manipulation of the businessLogo argument, implement URL validation, and consider updating or mitigating the issue until the project releases a fix.
Other vulnerabilities in vas3k TaxHacker
See all- CVE-2026-78062High
A vulnerability was identified in vas3k TaxHacker up to 0.8.2. The function envSchema.parse in lib/config.ts uses hard-coded credentials via the BETTER_AUTH_SECRET argument. The attack can be initiated remotely. The project was informed but has not responded.
- CVE-2026-78061Medium
A vulnerability was determined in vas3k TaxHacker up to 0.8.2. The function buildImapConfig in lib/email-sync/imap-client.ts is vulnerable to server-side request forgery via manipulation of host/port arguments. The attack can be launched remotely. A pull request to fix this issue awaits acceptance.
Original NVD description (English source)
A vulnerability was detected in vas3k TaxHacker up to 0.8.5. Affected is the function generateInvoicePDF of the file /apps/invoices/actions.ts of the component Invoice PDF Renderer. Performing a manipulation of the argument businessLogo results in server-side request forgery. The attack is possible to be carried out remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.