CVE-2026-55385 Details
Description
InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf's PDFConfigurationRequest.php validates the owner-controlled gotenberg_host setting only as a syntactically valid URL. GotenbergPDFDriver::loadView later sends a multipart HTTP request containing rendered invoice, estimate, or payment HTML as document.html to that host without rejecting private, loopback, link-local, or reserved addresses. An owner can use PDF generation to reach internal services or cloud metadata endpoints, and a configured external host receives customer names, addresses, line items, totals, and company identifiers from subsequent PDF renders. This issue is fixed in version 2.4.0.
A server-side request forgery (SSRF) vulnerability has been identified in InvoiceShelf versions prior to 2.4.0. The issue arises in the PDF configuration request, where the 'gotenberg_host' setting is validated only for syntactic URL correctness. This lax validation allows private, loopback, link-local, and reserved addresses to pass through. Consequently, an owner can exploit this by directing PDF generation to internal services or cloud metadata endpoints. The vulnerability also leads to the unintentional exposure of customer information, such as names, addresses, and financial details, to an external server during PDF rendering.
This vulnerability has been fixed in InvoiceShelf version 2.4.0. Users are advised to update to this version.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 14, 2026CISA-ADP
Assessed Oct 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/InvoiceShelf/InvoiceShelf/security/advisories/GHSA-mfxg-qphw-3f3g | CISA-ADP | AdvisoryExploitRemedyTechnical DescriptionVendor |
| https://github.com/InvoiceShelf/InvoiceShelf/commit/d615cfb4ff4841a3b8cda7fc850a2bb335521fe5 | [email protected] | Source CodeVendor |
| https://github.com/InvoiceShelf/InvoiceShelf/pull/664 | [email protected] | Issue TrackingVendor |
| https://github.com/InvoiceShelf/InvoiceShelf/releases/tag/2.4.0 | [email protected] | Release NotesVendor |
| https://github.com/InvoiceShelf/InvoiceShelf/security/advisories/GHSA-mfxg-qphw-3f3g | [email protected] | AdvisoryExploitRemedyTechnical DescriptionVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| InvoiceShelf | < 2.4.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 20, 2026 | CVE Modified | CISA-ADP |
| Oct 14, 2026 | New CVE Received | [email protected] |