# CVE-2026-83744: Invoice Ninja server-side request forgery in PDF rendering

Source: https://junglewise.ai/threats/cve-2026-83744-invoice-ninja-server-side-request-forgery-in-pdf-rendering  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-01. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-83744 · Severity: medium · CVSS 4.3 · Published 2026-09-01

Invoice Ninja is a web-based invoicing and expense management application. A vulnerability in its PDF rendering engine allows authenticated attackers to embed malicious links in invoice notes that the server will fetch during PDF generation. This could expose internal network resources, cloud metadata services, or administrative interfaces that should not be accessible from the internet.

Technologies: [Invoice Ninja](https://junglewise.ai/threats/technologies/invoice-ninja). Vendors: [Invoice Ninja](https://junglewise.ai/threats/vendors/invoice-ninja).

## Quick answers

**Is CVE-2026-83744 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-83744 being exploited in the wild.

**How severe is CVE-2026-83744?** Medium severity, with a CVSS score of 4.3, published 1 September 2026.

**Which products and versions are affected?** Invoice Ninja up to 5.13.26.

**Is there a fix for CVE-2026-83744?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-83744 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-83744?** Check whether you run Invoice Ninja at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a server-side request forgery (SSRF) in the Purify::isHostSafe() validation routine within app/Services/Pdf/Purify.php. The application validates hostnames in invoice notes using string-based blacklist checks for localhost, private IP ranges, and suspicious patterns, but fails to resolve hostnames to their actual IP addresses before allowing requests. An authenticated attacker can embed references to attacker-controlled domains that resolve to internal or restricted network addresses. When the server-side Chromium PDF renderer processes the invoice, it fetches these resources directly from the server infrastructure, enabling SSRF. Exploitation requires authentication and the ability to create or edit invoices.

## Affected products

- Invoice Ninja Invoice Ninja up to 5.13.26

## Timeline

- 2026-06: disclosed: Vulnerability discovered
- 2026-06-08: advisory: Vendor notified via responsible disclosure
- 2026-09-01: disclosed: Public disclosure via advisory and researcher writeup

## References

- [https://ashutosh-jena.in/blog/server-side-request-forgery-ssrf-in-invoice-ninja-pdf-rendering-v51326](https://ashutosh-jena.in/blog/server-side-request-forgery-ssrf-in-invoice-ninja-pdf-rendering-v51326)
- [https://vuldb.com/cve/CVE-2026-83744](https://vuldb.com/cve/CVE-2026-83744)

## Related threats

- [Invoice Ninja broken access control in vendor document download](https://junglewise.ai/threats/cve-2026-82029-invoice-ninja-before-5-13-28-contains-a-broken-access-control)
- [Invoice Ninja information disclosure via webhook components](https://junglewise.ai/threats/cve-2026-71626-invoice-ninja-information-disclosure-via-webhook-components)
- [Invoice Ninja authorization bypass in vendor portal profile](https://junglewise.ai/threats/cve-2026-83743-invoice-ninja-authorization-bypass-in-vendor-portal-profile)
- [Invoice Ninja open redirect in client portal login](https://junglewise.ai/threats/cve-2026-58450-invoice-ninja-open-redirect-in-client-portal-login)