PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-34367 InvoiceShelf CVE debrief

CVE-2026-34367 is a Server-Side Request Forgery (SSRF) vulnerability in InvoiceShelf, an open-source web & mobile app for expense tracking and invoicing. The vulnerability exists in the Invoice PDF generation module. User-supplied HTML in the invoice Notes field is passed unsanitized to the Dompdf rendering library, which can fetch remote resources referenced in the markup. This can be triggered via the PDF preview and email delivery endpoints. The issue was patched in version 2.2.0. Users of InvoiceShelf versions prior to 2.2.0 should apply the patch to prevent exploitation of this SSRF vulnerability.

Vendor
InvoiceShelf
Product
Unknown
CVSS
HIGH 7.6
CISA KEV
Not listed in stored evidence
Original CVE published
2026-03-31
Original CVE updated
2026-07-24
Advisory published
2026-03-31
Advisory updated
2026-07-24

Who should care

Users of InvoiceShelf versions prior to 2.2.0 should apply the patch to prevent exploitation of this SSRF vulnerability. Administrators of systems using InvoiceShelf should verify that their installations are updated to version 2.2.0 or later. Security teams should review the vulnerability's impact on their organization's systems and implement additional security measures to protect against SSRF attacks.

Technical summary

The SSRF vulnerability in InvoiceShelf arises from the unsanitized processing of user-supplied HTML in the invoice Notes field. When this HTML is rendered by the Dompdf library, it can lead to the fetching of remote resources, potentially allowing attackers to interact with internal or external systems. The vulnerability can be exploited through PDF preview and email delivery features. This issue was patched in version 2.2.0, and users should update to this version or later to mitigate the vulnerability.

Defensive priority

High

Recommended defensive actions

  • Apply the patch by updating InvoiceShelf to version 2.2.0 or later
  • Restrict access to the PDF preview and email delivery endpoints
  • Monitor for suspicious activity related to PDF generation and email delivery
  • Implement additional security measures to protect against SSRF attacks
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record was published on 2026-03-31T21:16:29.687Z and last modified on 2026-07-24T20:10:00.147Z. The NVD entry is currently Analyzed. Evidence is limited to public sources and may not reflect the full scope of affected systems or potential impacts. Defenders should verify the vulnerability's relevance to their environments and review official advisories for specific guidance.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-03-31T21:16:29.687Z and has not been modified since then. The NVD entry is currently Analyzed.