Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-55385— InvoiceShelf: SSRF via unvalidated Gotenberg PDF renderer host in PDF configuration

Quick assessment

Affected
InvoiceShelf InvoiceShelf
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

InvoiceShelf 是一款开源的 Web 和移动应用程序，帮助用户追踪支出、付款，并创建专业的发票和估算单。在 2.4.0 版本之前，InvoiceShelf 中的 PDFConfigurationRequest.php 仅对用户可控制的 gotenberg_host 设置进行语法上有效的 URL 验证，而未对其目标地址的类型进行限制。随后，GotenbergPDFDriver::loadView 方法会向该主机发送一个 multipart HTTP 请求，其中包含渲染后的发票、估算单或付款页面的 HTML

CVSS 6.8 · Medium EPSS 0.45% · P38

Affected Version Matrix 1

VendorProduct Version RangeStatus
InvoiceShelf InvoiceShelf < 2.4.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-55385

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
InvoiceShelf: SSRF via unvalidated Gotenberg PDF renderer host in PDF configuration
Source: CVE Program / CVE List V5
Vulnerability Description
InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf's PDFConfigurationRequest.php validates the owner-controlled gotenberg_host setting only as a syntactically valid URL. GotenbergPDFDriver::loadView later sends a multipart HTTP request containing rendered invoice, estimate, or payment HTML as document.html to that host without rejecting private, loopback, link-local, or reserved addresses. An owner can use PDF generation to reach internal services or cloud metadata endpoints, and a configured external host receives customer names, addresses, line items, totals, and company identifiers from subsequent PDF renders. This issue is fixed in version 2.4.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
InvoiceShelf InvoiceShelf < 2.4.0 -

II. Public POCs for CVE-2026-55385

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-55385

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-55385 (2)

Other References for CVE-2026-55385 (2)

Same Patch Batch · InvoiceShelf · 2026-10-14 · 7 CVEs total

CVE-2026-55383 8.2 HIGH InvoiceShelf: Public EmailLog token type confusion allows cross-company invoice disclosure
CVE-2026-55382 7.6 HIGH InvoiceShelf: Cross-company read/modify/delete of notes via missing company scope in NoteP
CVE-2026-55387 7.2 HIGH InvoiceShelf bulk deletion lacks company scoping
CVE-2026-55386 7.1 HIGH InvoiceShelf ORDER BY SQL injection through orderByField
CVE-2026-55381 7.1 HIGH InvoiceShelf: IDOR in InvoiceShelf estimate-to-invoice conversion allows any company user
CVE-2026-55384 5.3 MEDIUM InvoiceShelf trusts client-supplied document totals

IV. Related Vulnerabilities

Same product: InvoiceShelf
Same vendor: InvoiceShelf
Same weakness: CWE-918

V. Comments for CVE-2026-55385

No comments yet

Leave a comment