High severity · published Mar 31, 2026
CVE-2026-34367
InvoiceShelf: SSRF in Invoice PDF Rendering via Unsanitised HTML in Notes Field
8.7
CVSS
0.3%
EPSS
No
On KEV
Description
InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.2.0, a Server-Side Request Forgery (SSRF) vulnerability exists in the Invoice PDF generation module. User-supplied HTML in the invoice Notes field is passed unsanitised to the Dompdf rendering library, which will fetch any remote resources referenced in the markup. This can be triggered via the PDF preview and email delivery endpoints. This issue has been patched in version 2.2.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 19% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IN
InvoiceShelf · InvoiceShelf
< 2.2.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-34367
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-34367
Product
https://github.com/InvoiceShelf/InvoiceShelf/releases/tag/2.2.0
Exploit
https://github.com/InvoiceShelf/InvoiceShelf/security/advisories/GHSA-q9wx-ggwq-mcgh
More from InvoiceShelf
8.7
CVE-2026-55610
InvoiceShelf has cross-company user read/update IDOR that enables cross-tenant account takeover
8.2
CVE-2026-55383
InvoiceShelf: Public EmailLog token type confusion allows cross-company invoice disclosure
8.1
CVE-2026-34366
InvoiceShelf: SSRF in Payment Receipt PDF Rendering via Unsanitised HTML in Notes Field
8.1
CVE-2026-34365
InvoiceShelf: SSRF in Estimate PDF Rendering via Unsanitised HTML in Notes Field
7.6
CVE-2026-55382
InvoiceShelf: Cross-company read/modify/delete of notes via missing company scope in NotePolicy (BOLA/IDOR)