PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-34367 InvoiceShelf CVE debrief

CVE-2026-34367 is a Server-Side Request Forgery (SSRF) vulnerability in InvoiceShelf, an open-source web & mobile app for expense tracking and invoicing. The vulnerability exists in the Invoice PDF generation module. User-supplied HTML in the invoice Notes field is passed unsanitized to the Dompdf rendering library, which can fetch remote resources referenced in the markup. This can be triggered via the PDF preview and email delivery endpoints. The issue was patched in version 2.2.0. Users of InvoiceShelf versions prior to 2.2.0 should apply the patch to prevent exploitation of this SSRF vulnerability.

Vendor
InvoiceShelf
Product
Unknown
CVSS
HIGH 7.6
CISA KEV
Not listed in stored evidence
Original CVE published
2026-03-31
Original CVE updated
2026-07-24
Advisory published
2026-03-31
Advisory updated
2026-07-24

Who should care

Users of InvoiceShelf versions prior to 2.2.0 should apply the patch to prevent exploitation of this SSRF vulnerability. Administrators of systems using InvoiceShelf should verify that their installations are updated to version 2.2.0 or later. Security teams should review the vulnerability's impact on their organization's systems and implement additional security measures to protect against SSRF attacks.

Technical summary

The SSRF vulnerability in InvoiceShelf arises from the unsanitized processing of user-supplied HTML in the invoice Notes field. When this HTML is rendered by the Dompdf library, it can lead to the fetching of remote resources, potentially allowing attackers to interact with internal or external systems. The vulnerability can be exploited through PDF preview and email delivery features. This issue was patched in version 2.2.0, and users should update to this version or later to mitigate the vulnerability.

Defensive priority

High

Recommended defensive actions

  • Apply the patch by updating InvoiceShelf to version 2.2.0 or later
  • Restrict access to the PDF preview and email delivery endpoints
  • Monitor for suspicious activity related to PDF generation and email delivery
  • Implement additional security measures to protect against SSRF attacks
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record was published on 2026-03-31T21:16:29.687Z and last modified on 2026-07-24T20:10:00.147Z. The NVD entry is currently Analyzed. Evidence is limited to public sources and may not reflect the full scope of affected systems or potential impacts. Defenders should verify the vulnerability's relevance to their environments and review official advisories for specific guidance.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-34367 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-34367

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-34367 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-34367

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.