CVE-2026-94039 vas3k CVE debrief

Who should care

Defenders responsible for vas3k TaxHacker deployments should assess exposure and prioritize verification and mitigation. This includes operators, platform administrators, vulnerability management teams, and security teams who need to review the affected scope and apply patches or mitigations to prevent potential damage.

Why it matters

Defenders should care about CVE-2026-94039 because it allows for server-side request forgery in vas3k TaxHacker up to 0.8.5, which can be exploited remotely. The exploit is public and may be used. Verification and mitigation are crucial to prevent potential damage.

• Verify and apply patches or mitigations to prevent exploitation.
• Restrict access to the generateInvoicePDF function to limit potential damage.
• Monitor for potential exploitation attempts to detect and respond to attacks.

Technical summary

The vulnerability is caused by a server-side request forgery in the generateInvoicePDF function of the /apps/invoices/actions.ts file in the Invoice PDF Renderer component of vas3k TaxHacker up to 0.8.5. The attack can be carried out remotely by manipulating the businessLogo argument. Limited source detail is available, so defenders should focus on verifying the affected version and applying patches or mitigations without unsupported root-cause claims or exploit detail. The project was informed early but has not responded yet.

Defensive priority

Defenders should prioritize verifying the affected version and applying patches or mitigations.

Recommended defensive actions

• Verify the affected version of vas3k TaxHacker and apply patches or mitigations.
• Restrict access to the generateInvoicePDF function.
• Monitor for potential exploitation attempts.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability was detected in vas3k TaxHacker up to 0.8.5. The affected function is generateInvoicePDF in /apps/invoices/actions.ts. The exploit is public and may be used. Limited source detail is available, so defenders should verify the affected version and apply patches or mitigations. Evidence limits prevent further confirmation of scope or impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.