Is CVE-2026-34366 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-34366 being exploited in the wild.

How severe is CVE-2026-34366?

High severity, with a CVSS score of 7.6, published 31 March 2026.

Is there a fix for CVE-2026-34366?

A patch was published on 2026-03-24: Version 2.2.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-34366 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-34366?

Check whether you run Invoiceshelf at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-34366: InvoiceShelf SSRF in payment receipt PDF generation

CVE-2026-34366 · Severity: high · CVSS 7.6 · Published 2026-03-31

InvoiceShelf, an open-source platform for tracking expenses and managing invoices, contains a security flaw in its payment receipt generation system. An attacker with administrative access can inject malicious code into payment notes that forces the server to make unauthorized requests to internal or external systems. This could allow an attacker to scan private internal networks, steal cloud service credentials, or access sensitive internal data.

Technologies: Invoiceshelf. Vendors: Invoiceshelf.

Quick answers

Is CVE-2026-34366 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-34366 being exploited in the wild.
How severe is CVE-2026-34366?: High severity, with a CVSS score of 7.6, published 31 March 2026.
Which products and versions are affected?: Invoiceshelf < 2.2.0.
Is there a fix for CVE-2026-34366?: A patch was published on 2026-03-24: Version 2.2.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-34366 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-34366?: Check whether you run Invoiceshelf at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in InvoiceShelf's payment receipt PDF generation module. The root cause is the failure to sanitize user-supplied HTML in the payment 'Notes' field before passing it to the Dompdf rendering library. An attacker with high privileges can inject HTML tags (such as <img> or <iframe>) that trigger Dompdf to fetch remote or local resources. This can be exploited via the PDF receipt endpoint to perform internal network reconnaissance, access cloud metadata services (IMDS), or potentially read local files. The issue is fixed in version 2.2.0 by implementing HTML sanitization.

Affected products

InvoiceShelf InvoiceShelf < 2.2.0

Timeline

2026-03-24: patched: Version 2.2.0 released
2026-03-27: advisory: GitHub Security Advisory published
2026-03-31: disclosed: CVE-2026-34366 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.