CVE-2026-55385 in InvoiceShelf
Summary
by MITRE • 10/14/2026
InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf's PDFConfigurationRequest.php validates the owner-controlled gotenberg_host setting only as a syntactically valid URL. GotenbergPDFDriver::loadView later sends a multipart HTTP request containing rendered invoice, estimate, or payment HTML as document.html to that host without rejecting private, loopback, link-local, or reserved addresses. An owner can use PDF generation to reach internal services or cloud metadata endpoints, and a configured external host receives customer names, addresses, line items, totals, and company identifiers from subsequent PDF renders. This issue is fixed in version 2.4.0.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/14/2026
The vulnerability identified in InvoiceShelf prior to version 2.4.0 represents a critical server-side request forgery flaw rooted in insufficient input validation of the gotenberg_host configuration parameter within the PDFConfigurationRequest.php module. As an open-source application designed for tracking expenses, payments, and generating professional invoices, InvoiceShelf relies on external services like Gotenberg to render HTML content into portable document format files. The core technical deficiency lies in the fact that while the system validates whether the provided host string is syntactically a valid URL, it fails to perform semantic validation regarding the nature of the target address. This oversight allows an attacker with administrative access or the ability to modify configuration settings to specify internal IP addresses, loopback interfaces such as 127.0.0.1, link-local addresses, or reserved ranges that are typically inaccessible from external networks but fully reachable within the local network environment where InvoiceShelf is deployed.
This architectural weakness enables a classic Server-Side Request Forgery attack vector, allowing an authenticated administrator to force the application server to initiate HTTP requests to arbitrary destinations controlled by the attacker or targeted internal services. When the PDF generation process is triggered via GotenbergPDFDriver::loadView, the system constructs and sends a multipart HTTP request containing sensitive document data as document.html to the specified host. Because there are no restrictions on private or reserved address spaces, an adversary can direct this traffic toward internal microservices, database interfaces, cloud metadata endpoints like those found in AWS EC2 instance metadata service 169.254.169.254, or other critical infrastructure components that should not be exposed to the application layer's document rendering logic. This capability effectively bypasses network perimeter defenses since the request originates from a trusted internal server IP address, often allowing access to services protected by firewall rules that whitelist local traffic but block external connections.
The operational impact of this vulnerability is twofold, involving both potential unauthorized access to internal systems and significant data exfiltration risks. By targeting cloud metadata endpoints or internal APIs, an attacker could potentially retrieve authentication tokens, configuration secrets, or other sensitive credentials stored in the environment's metadata service, leading to further compromise of the infrastructure. Simultaneously, any external host configured as the destination for PDF generation will receive full copies of customer names, addresses, line items, financial totals, and company identifiers embedded within the rendered documents. This constitutes a severe breach of confidentiality and privacy compliance standards such as GDPR or HIPAA if applicable data is involved, as sensitive business information is transmitted to an untrusted third-party server under the guise of routine document processing operations.
From a classification perspective, this issue aligns with CWE-918 Server-Side Request Forgery (SSRF), specifically highlighting the failure to validate against private IP address ranges and reserved addresses which falls under broader categories of improper input validation often associated with CWE-20 Improper Input Validation. In terms of tactical mapping within the MITRE ATT&CK framework, this vulnerability facilitates initial access or credential acquisition through techniques such as T1598 Phishing for Information via Cloud Metadata Services if targeting cloud environments, or T1071 Application Layer Protocol abuse to communicate with internal services. The exploitation path typically involves an attacker leveraging their existing administrative privileges within the InvoiceShelf interface to modify configuration settings and then triggering a PDF generation event to execute the malicious request.
To mitigate this vulnerability, organizations must immediately upgrade to version 2.4.0 or later where the developers have implemented proper validation logic to reject private, loopback, link-local, and reserved IP addresses in the gotenberg_host setting. For environments running older versions that cannot be instantly patched, a robust network-level mitigation strategy should be employed by configuring firewalls or reverse proxies to block outbound HTTP requests from the InvoiceShelf server application layer to internal subnets and cloud metadata ranges. Additionally, implementing strict allow-listing for external hosts ensures that only known, trusted PDF rendering services can receive data, thereby preventing accidental or malicious exfiltration of sensitive document content. Regular security audits of configuration parameters in web applications are essential to prevent similar SSRF flaws where syntactic validity is mistaken for semantic safety.