Is CVE-2026-34367 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-34367 being exploited in the wild.

How severe is CVE-2026-34367?

High severity, with a CVSS score of 7.6, published 31 March 2026.

Is there a fix for CVE-2026-34367?

A patch was published on 2026-03-24: Version 2.2.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-34367 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-34367?

Check whether you run Invoiceshelf at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-34367: InvoiceShelf SSRF in Invoice PDF generation module

CVE-2026-34367 · Severity: high · CVSS 7.6 · Published 2026-03-31

InvoiceShelf is an open-source application used for managing business expenses and generating professional invoices. A security flaw in the invoice generation system allows users with high-level permissions to force the server to make unauthorized requests to internal or external websites. This could lead to the exposure of sensitive internal data, access to cloud service credentials, or unauthorized scanning of the company's private network.

Technologies: Invoiceshelf. Vendors: Invoiceshelf.

Quick answers

Is CVE-2026-34367 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-34367 being exploited in the wild.
How severe is CVE-2026-34367?: High severity, with a CVSS score of 7.6, published 31 March 2026.
Which products and versions are affected?: Invoiceshelf < 2.2.0.
Is there a fix for CVE-2026-34367?: A patch was published on 2026-03-24: Version 2.2.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-34367 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-34367?: Check whether you run Invoiceshelf at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in InvoiceShelf's PDF generation module due to insufficient sanitization of the 'Notes' field. When an invoice is rendered as a PDF via the Dompdf library, unsanitized HTML tags (such as <img> or <link>) are processed, causing the server to fetch remote resources. An attacker with high privileges can exploit this via the PDF preview or email delivery endpoints to perform internal network reconnaissance, access cloud metadata services (e.g., AWS/GCP), or potentially read local files. If Dompdf's 'isPhpEnabled' setting is active, this could also lead to remote code execution. The issue is resolved in version 2.2.0 by implementing HTML sanitization for the Notes field.

Affected products

InvoiceShelf InvoiceShelf < 2.2.0

Timeline

2026-03-24: patched: Version 2.2.0 released
2026-03-27: advisory: GitHub Security Advisory published
2026-03-31: disclosed: CVE-2026-34367 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.