Executive brief
TaxHacker is a self-hosted accounting application that generates PDF invoices. An unauthenticated attacker can remotely trigger PDF generation with a malicious business logo parameter, allowing them to read arbitrary files from the server or probe internal network services. In multi-tenant deployments, this could expose other users' invoices and internal infrastructure.
Technical details
The generateInvoicePDF server action in /apps/invoices/actions.ts lacks authentication checks and passes the businessLogo parameter unsanitized to the @react-pdf/renderer image resolver. The resolver treats absolute filesystem paths as local files (calling fs.readFile) and http/https URLs as remote resources (making fetch requests), enabling both local file read and server-side request forgery. The action is reachable without authentication via POST with a Next-Action header.
Affected products
- vas3k TaxHacker up to 0.8.5
Timeline
- 2026-08-26: disclosed: Security issue #186 reported on GitHub
- 2026-09-20: advisory: CVE-2026-94039 published