CVE-2026-94039 vas3k CVE debrief

Who should care

Defenders responsible for vas3k TaxHacker deployments should assess exposure and prioritize verification and mitigation. This includes operators, platform administrators, vulnerability management teams, and security teams who need to review the potential impact of this vulnerability on their systems and take necessary actions to prevent potential attacks.

Why it matters

Defenders should care about CVE-2026-94039 because it allows for server-side request forgery in vas3k TaxHacker up to 0.8.5, which can be exploited remotely. Verification and mitigation are crucial to prevent potential attacks.

• Verify potential exposure to server-side request forgery attacks
• Assess the impact of a potential exploit on your systems
• Prioritize patching or mitigating the vulnerability

Technical summary

The vulnerability is located in the generateInvoicePDF function of the /apps/invoices/actions.ts file in the Invoice PDF Renderer component of vas3k TaxHacker up to 0.8.5. It allows for server-side request forgery by manipulating the businessLogo argument. The attack can be carried out remotely and a public exploit exists. This vulnerability can be exploited remotely, and defenders should prioritize verifying the presence of this vulnerability in their systems and applying patches or mitigations as available. The vulnerability allows for server-side request forgery, which can lead to potential security breaches.

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their systems and applying patches or mitigations as available.

Recommended defensive actions

• Verify the presence of this vulnerability in your systems
• Apply patches or mitigations as available
• Monitor for potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability was detected in vas3k TaxHacker up to 0.8.5. The affected function is generateInvoicePDF in /apps/invoices/actions.ts. The vulnerability allows for server-side request forgery by manipulating the businessLogo argument. The attack can be carried out remotely and a public exploit exists.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.