CVE-2026-94039: vas3k TaxHacker Invoice PDF Renderer actions.ts generateInvoicePDF server-side request forgery
A vulnerability was detected in vas3k TaxHacker up to 0.8.5. Affected is the function generateInvoicePDF of the file /apps/invoices/actions.ts of the component Invoice PDF Renderer. Performing a manipulation of the argument businessLogo results in server-side request forgery. The attack is possible to be carried out remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
The vulnerability can be exploited remotely and does not require privileges or user interaction, according to the supplied severity vector. Systems running affected vas3k TaxHacker versions up to 0.8.5 are exposed through the Invoice PDF Renderer path.
What input is involved in exploitation?
An attacker manipulates the businessLogo argument handled by generateInvoicePDF in /apps/invoices/actions.ts. This can cause the server to make a request to an attacker-chosen destination.
Is public exploit information available?
Yes. The available data states that an exploit is public and may be used.
How urgent is remediation?
This is rated high severity with a 7.3 score and has a public exploit. The project was reportedly notified through an issue report but had not responded at the time of the report.