CVE-2026-34366: Invoiceshelf SSRF Vulnerability

CVE-2026-34366 Overview

CVE-2026-34366 is a Server-Side Request Forgery (SSRF) vulnerability in InvoiceShelf, an open-source web and mobile application for tracking expenses, payments, invoices, and estimates. Versions prior to 2.2.0 pass user-supplied HTML from the payment Notes field unsanitized to the Dompdf rendering library during payment receipt PDF generation. Dompdf then fetches any remote resources referenced in the markup, enabling authenticated attackers to issue outbound HTTP requests from the InvoiceShelf server. The flaw is exploitable through the PDF receipt endpoint directly, independent of whether automated email attachments are configured. Maintainers patched the issue in version 2.2.0.

Critical Impact
Authenticated attackers can force the InvoiceShelf server to issue HTTP requests to arbitrary internal or external hosts, exposing internal network services and metadata endpoints.

Affected Products

InvoiceShelf versions prior to 2.2.0
Self-hosted InvoiceShelf web application deployments
Any InvoiceShelf instance with the payment receipt PDF generation feature enabled

Discovery Timeline

2026-03-31 - CVE CVE-2026-34366 published to NVD
2026-04-07 - Last updated in NVD database

Technical Details for CVE-2026-34366

Vulnerability Analysis

The vulnerability resides in the payment receipt PDF generation module of InvoiceShelf. When a user adds content to the payment Notes field, that content is later embedded into an HTML template and handed to the Dompdf library to produce a PDF receipt. Dompdf, by default, resolves and fetches remote resources referenced in tags such as <img>, <link>, and CSS @import directives. Because InvoiceShelf does not sanitize the Notes content or restrict Dompdf's remote resource fetching, an attacker controlling that field can cause the server to perform outbound HTTP requests to arbitrary URLs. This is classified as [CWE-918] Server-Side Request Forgery.

Root Cause

The root cause is the absence of input sanitization on the payment Notes field combined with a permissive Dompdf configuration that allows remote resource loading. User input intended as plain notes is rendered as HTML and treated as trusted markup by the PDF engine.

Attack Vector

An authenticated user with the ability to create or edit payment records submits a Notes field containing HTML markup that references an attacker-chosen URL, such as an internal service, a cloud metadata endpoint, or an external collector. Triggering the PDF receipt endpoint causes Dompdf to fetch that URL from the server context. The attacker can probe internal network ranges, retrieve responses surfaced in the rendered PDF, or interact with metadata services such as 169.254.169.254 in cloud deployments. The vulnerability does not depend on automated email attachment delivery being enabled.

No verified public exploit code is available. See the GitHub Security Advisory GHSA-38hf-fq8x-q49r for additional technical detail.

Detection Methods for CVE-2026-34366

Indicators of Compromise

Outbound HTTP or HTTPS requests originating from the InvoiceShelf application server to internal IP ranges (RFC1918) or cloud metadata addresses such as 169.254.169.254.
Payment records containing HTML tags such as <img src="...">, <link>, or CSS @import statements within the Notes field.
Anomalous traffic from the InvoiceShelf host to previously unseen external domains during PDF receipt generation events.

Detection Strategies

Inspect database entries in payment Notes columns for HTML markup or URL patterns inconsistent with normal user input.
Correlate web server access logs for hits on the payment receipt PDF endpoint with outbound network connections from the application host.
Enable Dompdf debug or HTTP client logging to record every remote URL fetched during PDF rendering.

Monitoring Recommendations

Monitor egress traffic from the InvoiceShelf server and alert on connections to internal subnets, link-local addresses, or unexpected destinations.
Track the volume and timing of PDF receipt endpoint requests per authenticated user to identify abuse patterns.
Forward application and proxy logs to a centralized analytics platform for retrospective hunting against suspicious URL patterns in payment data.

How to Mitigate CVE-2026-34366

Immediate Actions Required

Upgrade InvoiceShelf to version 2.2.0 or later, which contains the official fix.
Audit existing payment records for HTML or URL content in the Notes field and remove suspicious entries.
Restrict outbound network access from the InvoiceShelf server to only the destinations required for normal operation.

Patch Information

The vulnerability is fixed in InvoiceShelf 2.2.0. Refer to the GitHub Release 2.2.0 and the GitHub Security Advisory GHSA-38hf-fq8x-q49r for full remediation guidance.

Workarounds

Block the InvoiceShelf server from reaching cloud metadata endpoints such as 169.254.169.254 and internal management subnets at the network layer.
Place the application behind an egress proxy that allowlists only required external destinations.
Limit access to payment creation and editing functionality to trusted users until the upgrade is applied.

bash

# Example egress firewall rule (iptables) to block cloud metadata access from the app host
iptables -A OUTPUT -d 169.254.169.254 -j DROP
iptables -A OUTPUT -d 10.0.0.0/8 -p tcp --dport 80 -j DROP
iptables -A OUTPUT -d 10.0.0.0/8 -p tcp --dport 443 -j DROP