Executive brief
InvoiceShelf, an open-source platform for tracking expenses and managing invoices, contains a security flaw in its payment receipt generation system. An attacker with administrative access can inject malicious code into payment notes that forces the server to make unauthorized requests to internal or external systems. This could allow an attacker to scan private internal networks, steal cloud service credentials, or access sensitive internal data.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in InvoiceShelf's payment receipt PDF generation module. The root cause is the failure to sanitize user-supplied HTML in the payment 'Notes' field before passing it to the Dompdf rendering library. An attacker with high privileges can inject HTML tags (such as <img> or <iframe>) that trigger Dompdf to fetch remote or local resources. This can be exploited via the PDF receipt endpoint to perform internal network reconnaissance, access cloud metadata services (IMDS), or potentially read local files. The issue is fixed in version 2.2.0 by implementing HTML sanitization.
Affected products
- InvoiceShelf InvoiceShelf < 2.2.0
Timeline
- 2026-03-24: patched: Version 2.2.0 released
- 2026-03-27: advisory: GitHub Security Advisory published
- 2026-03-31: disclosed: CVE-2026-34366 published