InvoiceShelf up to 2.3.x PDF Generation PDFConfigurationRequest.php loadView gotenberg_host server-side request forgery

Summaryinfo

A vulnerability, which was classified as problematic, was found in InvoiceShelf up to 2.3.x. This impacts the function GotenbergPDFDriver::loadView of the file PDFConfigurationRequest.php of the component PDF Generation. Executing a manipulation of the argument gotenberg_host can lead to server-side request forgery. This vulnerability is tracked as CVE-2026-55385. The attack can be launched remotely. No exploit exists. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in InvoiceShelf up to 2.3.x. It has been declared as problematic. This vulnerability affects the function GotenbergPDFDriver::loadView of the file PDFConfigurationRequest.php of the component PDF Generation. The manipulation of the argument gotenberg_host with an unknown input leads to a server-side request forgery vulnerability. The CWE definition for the vulnerability is CWE-918. The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. As an impact it is known to affect confidentiality. CVE summarizes:

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf's PDFConfigurationRequest.php validates the owner-controlled gotenberg_host setting only as a syntactically valid URL. GotenbergPDFDriver::loadView later sends a multipart HTTP request containing rendered invoice, estimate, or payment HTML as document.html to that host without rejecting private, loopback, link-local, or reserved addresses. An owner can use PDF generation to reach internal services or cloud metadata endpoints, and a configured external host receives customer names, addresses, line items, totals, and company identifiers from subsequent PDF renders. This issue is fixed in version 2.4.0.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-55385 since 06/16/2026. The exploitation appears to be easy. The attack can be initiated remotely. Additional levels of successful authentication are required for exploitation. There are known technical details, but no exploit is available.

By approaching the search of inurl:PDFConfigurationRequest.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 2.4.0 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Name

• InvoiceShelf

Version

• 2.0
• 2.1
• 2.2
• 2.3

Website

• Product: https://github.com/InvoiceShelf/InvoiceShelf/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion