CVE-2026-55385: InvoiceShelf: SSRF via unvalidated Gotenberg PDF renderer host in PDF configuration
InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf's PDFConfigurationRequest.php validates the owner-controlled gotenberghost setting only as a syntactically valid URL. GotenbergPDFDriver::loadView later sends a multipart HTTP request containing rendered invoice, estimate, or payment HTML as document.html to that host without rejecting private, loopback, link-local, or reserved addresses. An owner can use PDF generation to reach internal services or cloud metadata endpoints, and a configured external host receives customer names, addresses, line items, totals, and company identifiers from subsequent PDF renders. This issue is fixed in version 2.4.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
InvoiceShelfto a version that resolves this vulnerability.Fixed in 2.4.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated InvoiceShelf owner who can control the gotenberg_host PDF setting can exploit it. The attacker can trigger PDF generation after configuring that host.
What systems and data are at risk?
The affected application can send PDF-rendering requests to internal services and cloud metadata endpoints, including private, loopback, link-local, and reserved addresses. If the configured host is external, subsequent PDF renders can disclose customer names, addresses, line items, totals, and company identifiers to that host.
Are default deployments affected?
Exploitation requires control of the owner-managed gotenberg_host setting, so the issue depends on how PDF rendering is configured and who has owner access. The provided information does not establish that the default host configuration is vulnerable.
What should be done if an immediate upgrade is not possible?
Restrict owner access to the PDF configuration and ensure gotenberg_host cannot be set to private, loopback, link-local, reserved, cloud metadata, or untrusted external addresses. Limit the application's outbound network access so PDF rendering cannot reach internal services or metadata endpoints.
How can I determine whether I need the fix?
Check whether the InvoiceShelf instance is earlier than 2.4.0 and whether PDF rendering uses the gotenberg_host setting. Review its configured value and outbound PDF-rendering requests for internal-address targets or unexpected external destinations.