CVE-2026-55385 InvoiceShelf CVE debrief

Who should care

Defenders of InvoiceShelf installations, particularly those with exposed PDF generation features, should assess their exposure and update to version 2.4.0 or later. They should also restrict access to the PDF configuration and validate user input to prevent similar vulnerabilities.

Why it matters

The SSRF vulnerability in InvoiceShelf allows an owner to send HTTP requests to internal services or cloud metadata endpoints, potentially exposing sensitive information. Defenders should assess their exposure, update to version 2.4.0 or later, restrict access to the PDF configuration, and validate user input.

• Potential exposure of sensitive information, including customer names, addresses, and financial data
• Possible disruption of internal services or cloud metadata endpoints
• Need for validation of user input to prevent similar vulnerabilities
• Requirement for defenders to review and update InvoiceShelf installations

Technical summary

The vulnerability was caused by the lack of validation for the 'gotenberg_host' setting in the PDF configuration of InvoiceShelf. This allowed an owner to send HTTP requests to internal services or cloud metadata endpoints, potentially exposing sensitive information, including customer names, addresses, and financial data. The issue was fixed in version 2.4.0. Defenders should assess their exposure, update to version 2.4.0 or later, restrict access to the PDF configuration, and validate user input to prevent similar vulnerabilities.

Defensive priority

Medium

Recommended defensive actions

• Review and update InvoiceShelf to version 2.4.0 or later
• Restrict access to the PDF configuration and validate user input
• Monitor for suspicious activity and implement compensating controls
• Confirm whether affected InvoiceShelf deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The vulnerability was reported in the CVE Program record and the NVD vulnerability detail page. The source item provided details about the SSRF vulnerability in InvoiceShelf. Additional information was obtained from GitHub references.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.