CVE-2026-83744 Overview
CVE-2026-83744 is a Server-Side Request Forgery (SSRF) vulnerability affecting Invoice Ninja versions up to 5.13.26. The flaw resides in the Purify::isHostSafe function within app/Services/Pdf/Purify.php, which handles PDF rendering for the invoices endpoint. An authenticated attacker can manipulate the notes argument to force the server to issue arbitrary outbound HTTP requests. The vulnerability was disclosed publicly, and the vendor did not respond to disclosure attempts. Categorized under [CWE-918], the issue enables remote exploitation over the network with low privileges.
Critical Impact
Authenticated attackers can abuse the PDF rendering flow to reach internal network resources, cloud metadata endpoints, and other services normally inaccessible from the public internet.
Affected Products
- Invoice Ninja versions up to and including 5.13.26
- Component: app/Services/Pdf/Purify.php
- Endpoint: invoices (PDF rendering flow)
Discovery Timeline
- 2026-09-01 - CVE-2026-83744 published to NVD
- 2026-09-02 - Last updated in NVD database
Technical Details for CVE-2026-83744
Vulnerability Analysis
The vulnerability exists in the PDF rendering pipeline of Invoice Ninja. When generating invoice PDFs, the application processes user-controlled content from the notes field. The Purify::isHostSafe function in app/Services/Pdf/Purify.php is responsible for validating host references embedded in that content before the rendering engine fetches them.
The validation logic fails to properly restrict internal or reserved network destinations. As a result, an authenticated user can inject references to arbitrary URLs, and the server issues outbound HTTP requests during PDF generation. This behavior converts a benign document-generation feature into an SSRF primitive.
Successful exploitation exposes internal services, cloud instance metadata endpoints, and other network resources reachable from the Invoice Ninja host. The vulnerability requires network access to the invoices endpoint and valid low-privilege credentials.
Root Cause
The root cause is insufficient host validation in Purify::isHostSafe. The function does not enforce an effective allow-list or block private, loopback, link-local, and cloud metadata address ranges. Attacker-supplied URLs pass validation and are subsequently fetched by the rendering component.
Attack Vector
Exploitation requires an authenticated session against the target Invoice Ninja instance. The attacker submits or updates an invoice with a crafted notes value referencing an internal or attacker-controlled URL. When the PDF is generated, the server dereferences the URL, leaking response data or performing side effects against internal services.
No verified proof-of-concept code is published in the enriched data. Refer to the Personal Blog on SSRF Vulnerability and VulDB CVE-2026-83744 Details for technical write-ups.
Detection Methods for CVE-2026-83744
Indicators of Compromise
- Outbound HTTP requests from the Invoice Ninja application host to internal IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or loopback (127.0.0.0/8).
- Requests originating from the PDF rendering process to cloud metadata endpoints such as 169.254.169.254.
- Invoice records containing notes fields with URLs referencing internal hostnames, private IPs, or non-standard schemes.
Detection Strategies
- Inspect application and web server logs for invoice creation or update requests containing URL patterns in the notes parameter.
- Correlate PDF generation events with unexpected outbound network connections from the application server.
- Deploy egress filtering telemetry to flag requests from the Invoice Ninja process to non-approved destinations.
Monitoring Recommendations
- Enable full request logging on the invoices endpoint and retain payloads for post-incident review.
- Monitor DNS queries originating from the application host for suspicious lookups tied to PDF rendering activity.
- Alert on any connection attempts from the application to cloud metadata services or reserved address ranges.
How to Mitigate CVE-2026-83744
Immediate Actions Required
- Restrict access to the Invoice Ninja administrative and invoicing endpoints to trusted users and networks only.
- Implement egress filtering that blocks the application host from reaching private address ranges and cloud metadata endpoints.
- Audit existing invoice records for suspicious URL content in the notes field.
Patch Information
The vendor did not respond to disclosure attempts, and no official patch is referenced in the enriched data at the time of publication. Monitor the Invoice Ninja project and vendor channels for updates beyond version 5.13.26.
Workarounds
- Place Invoice Ninja behind an egress proxy that enforces an allow-list of permitted external destinations.
- Disable or restrict PDF rendering features for untrusted users until a fix is available.
- Deploy network segmentation to isolate the Invoice Ninja host from internal management interfaces and cloud metadata services.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
