Remote Code Execution Vulnerability in InvoiceShelf Open-source App
CVE-2026-55385
What is CVE-2026-55385?
InvoiceShelf, an open-source web and mobile application, suffered from inadequate input validation in its PDFConfigurationRequest.php file prior to version 2.4.0. The application only checked if the owner-controlled setting 'gotenberg_host' was a syntactically valid URL, allowing an attacker to specify private, loopback, link-local, or reserved addresses. This oversight enables adversaries to leverage the PDF generation functionality to reach sensitive internal services or cloud metadata endpoints. Personal and financial data such as customer names, addresses, and transaction details could be inadvertently exposed to an external host utilized for rendering PDFs. The issue has been remediated in the latest version, 2.4.0.
Affected Version(s)
InvoiceShelf < 2.4.0