CVE-2026-55385
MEDIUM 6.8InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf's PDFConfigurationRequest.php validates the owner-controlled gotenberg_host setting only as a syntactically valid URL. GotenbergPDFDriver::loadView later sends a multipart HTTP request containing rendered invoice, estimate, or payment HTML as document.html to that host without rejecting private, loopback, link-local, or reserved addresses. An owner can use PDF generation to reach internal services or cloud metadata endpoints, and a configured external host receives customer names, addresses, line items, totals, and company identifiers from subsequent PDF renders. This issue is fixed in version 2.4.0.
No known exploitation, public exploit, or elevated probability at this time. Track for changes.
Exploitation likelihood
0.6%chance of exploitation in 30 days · 47th percentile
Impact if exploited
6.8CVSS 3.1 · MEDIUM
- ConfidentialityHigh
- IntegrityNone
- AvailabilityNone
What an attacker needs
- ✓Access: Reachable over the network — no local access needed
- ⚠Privileges: Requires an admin / high-privilege account
- ✓User interaction: No user interaction needed
- ✓Complexity: No special conditions — reliably repeatable
✓ lowers the bar for an attacker · ⚠ raises it
Proof of concept
No public PoC is currently catalogued.
Search for new PoCs
Search GitHub now — results may be empty or unverified.
Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.
Data snapshot:
Weakness (CWE)
- CWE-918: : Server-Side Request Forgery (SSRF)
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
References and research data (JSON)
All CVSS metrics
- MEDIUM 6.8 v3.1 · CNA Primary
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N - MEDIUM 6.8 v3.1 · NVD Secondary
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
References
Exploit-tagged references (not proof of a PoC)
- https://github.com/InvoiceShelf/InvoiceShelf/security/advisories/GHSA-mfxg-qphw-3f3g CVE record · GitHub_M · Updated 2026-10-14T19:25:32.410Z
CVE record · CISA-ADP · Updated 2026-10-20T02:02:13.638Z
NVD · CVE-2026-55385 · Updated 2026-10-20T03:17:15.487
Advisories
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-101612 EUVD · EUVD-2026-101612
Technical & other
- https://github.com/InvoiceShelf/InvoiceShelf/pull/664 CVE record · GitHub_M · Updated 2026-10-14T19:25:32.410Z
NVD · CVE-2026-55385 · Updated 2026-10-20T03:17:15.487 - https://github.com/InvoiceShelf/InvoiceShelf/commit/d615cfb4ff4841a3b8cda7fc850a2bb335521fe5 CVE record · GitHub_M · Updated 2026-10-14T19:25:32.410Z
NVD · CVE-2026-55385 · Updated 2026-10-20T03:17:15.487 - https://github.com/InvoiceShelf/InvoiceShelf/releases/tag/2.4.0 CVE record · GitHub_M · Updated 2026-10-14T19:25:32.410Z
NVD · CVE-2026-55385 · Updated 2026-10-20T03:17:15.487