CVE-2026-34366 in InvoiceShelf
Summary
by MITRE • 04/01/2026
InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.2.0, a Server-Side Request Forgery (SSRF) vulnerability exists in the Payment receipt PDF generation module. User-supplied HTML in the payment Notes field is passed unsanitised to the Dompdf rendering library, which will fetch any remote resources referenced in the markup. The vulnerability is exploitable directly via the PDF receipt endpoint, regardless of whether automated email attachments are enabled. This issue has been patched in version 2.2.0.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/25/2026
The vulnerability identified as CVE-2026-34366 represents a critical Server-Side Request Forgery flaw within InvoiceShelf's payment receipt generation functionality. This issue affects versions prior to 2.2.0 and demonstrates a fundamental failure in input validation and sanitization within the application's PDF rendering pipeline. The vulnerability specifically resides in the Payment receipt PDF generation module where user-supplied content from the Notes field undergoes unsanitized processing before being passed to the Dompdf library for rendering. This architectural weakness creates a direct pathway for malicious actors to manipulate the system's behavior by injecting arbitrary HTML markup containing external resource references.
The technical exploitation of this vulnerability occurs through the PDF receipt endpoint which serves as the primary attack vector regardless of email attachment configurations. When user input containing malicious HTML is processed by the Dompdf library, the rendering engine attempts to fetch remote resources referenced in the markup including external images, scripts, or other web resources. This behavior enables attackers to perform unauthorized network requests from the server hosting InvoiceShelf, potentially allowing them to access internal network resources, exfiltrate data, or perform further reconnaissance activities. The vulnerability directly maps to CWE-918, which specifically addresses Server-Side Request Forgery vulnerabilities where applications fail to properly validate or sanitize user-supplied URLs or resource references.
The operational impact of this vulnerability extends beyond simple data theft or unauthorized access. An attacker could leverage this flaw to conduct internal network scanning, access sensitive backend services, or establish command and control channels through the compromised server. The attack surface is particularly concerning given that the vulnerability is exploitable directly via the PDF generation endpoint, meaning no additional authentication or privilege escalation is required. This aligns with ATT&CK technique T1071.004 which covers Application Layer Protocol: DNS, where attackers can use legitimate application functions to perform malicious activities. The vulnerability's persistence across different email configurations indicates that the risk remains consistent regardless of how payment notifications are delivered, making it particularly dangerous for organizations that rely on automated processing.
Organizations utilizing InvoiceShelf versions prior to 2.2.0 should immediately implement mitigation strategies while planning for the mandatory upgrade to address this security gap. The most effective immediate measure involves implementing strict input validation and sanitization for all user-supplied content, particularly within fields that may be processed through rendering libraries. This approach should include filtering out or escaping any HTML markup that contains external resource references. Additionally, network-level restrictions should be implemented to prevent outbound connections from the InvoiceShelf server to potentially malicious external domains. The patch released in version 2.2.0 addresses the core issue by introducing proper sanitization of user input before processing through the Dompdf library, thereby preventing the unintended resource fetching behavior that enabled the SSRF attack. Security teams should also consider implementing monitoring for unusual outbound network requests from the application server to detect potential exploitation attempts.