CVE-2026-34366: InvoiceShelf: SSRF in Payment Receipt PDF Rendering via Unsanitised HTML in Notes Field
InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.2.0, a Server-Side Request Forgery (SSRF) vulnerability exists in the Payment receipt PDF generation module. User-supplied HTML in the payment Notes field is passed unsanitised to the Dompdf rendering library, which will fetch any remote resources referenced in the markup. The vulnerability is exploitable directly via the PDF receipt endpoint, regardless of whether automated email attachments are enabled. This issue has been patched in version 2.2.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
InvoiceShelfto a version that resolves this vulnerability.Fixed in 2.2.0 - Compensating control
If you cannot upgrade to 2.2.0 immediately, restrict outbound network access from the InvoiceShelf server (e.g., via firewall/egress filtering) to limit the ability of the Dompdf PDF rendering to fetch remote resources referenced in the user-supplied payment Notes field.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-34366?
CVE-2026-34366 is classified as a medium severity vulnerability due to the potential for SSRF exploitation.
How do I fix CVE-2026-34366?
To fix CVE-2026-34366, upgrade InvoiceShelf to version 2.2.0 or later as it addresses the SSRF vulnerability.
What is the impact of CVE-2026-34366?
The impact of CVE-2026-34366 includes potential unauthorized access to internal services and sensitive data through SSRF.
Is my version of InvoiceShelf affected by CVE-2026-34366?
If you are using InvoiceShelf version prior to 2.2.0, your system is vulnerable to CVE-2026-34366.
Where can I find more information about CVE-2026-34366?
More information about CVE-2026-34366 can be found in security advisories and the release notes related to InvoiceShelf.