Is CVE-2026-83744 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-83744 being exploited in the wild.

How severe is CVE-2026-83744?

Medium severity, with a CVSS score of 4.3, published 1 September 2026.

Is there a fix for CVE-2026-83744?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-83744 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-83744?

Check whether you run Invoice Ninja at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-83744: Invoice Ninja server-side request forgery in PDF rendering

CVE-2026-83744 · Severity: medium · CVSS 4.3 · Published 2026-09-01

Invoice Ninja is a web-based invoicing and expense management application. A vulnerability in its PDF rendering engine allows authenticated attackers to embed malicious links in invoice notes that the server will fetch during PDF generation. This could expose internal network resources, cloud metadata services, or administrative interfaces that should not be accessible from the internet.

Technologies: Invoice Ninja. Vendors: Invoice Ninja.

Quick answers

Is CVE-2026-83744 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-83744 being exploited in the wild.
How severe is CVE-2026-83744?: Medium severity, with a CVSS score of 4.3, published 1 September 2026.
Which products and versions are affected?: Invoice Ninja up to 5.13.26.
Is there a fix for CVE-2026-83744?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-83744 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-83744?: Check whether you run Invoice Ninja at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a server-side request forgery (SSRF) in the Purify::isHostSafe() validation routine within app/Services/Pdf/Purify.php. The application validates hostnames in invoice notes using string-based blacklist checks for localhost, private IP ranges, and suspicious patterns, but fails to resolve hostnames to their actual IP addresses before allowing requests. An authenticated attacker can embed references to attacker-controlled domains that resolve to internal or restricted network addresses. When the server-side Chromium PDF renderer processes the invoice, it fetches these resources directly from the server infrastructure, enabling SSRF. Exploitation requires authentication and the ability to create or edit invoices.

Affected products

Invoice Ninja Invoice Ninja up to 5.13.26

Timeline

2026-06: disclosed: Vulnerability discovered
2026-06-08: advisory: Vendor notified via responsible disclosure
2026-09-01: disclosed: Public disclosure via advisory and researcher writeup

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.