CVE-2026-94039 Overview
CVE-2026-94039 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] in vas3k TaxHacker versions up to 0.8.5. The flaw resides in the generateInvoicePDF function within /apps/invoices/actions.ts, part of the Invoice PDF Renderer component. Attackers can manipulate the businessLogo argument to coerce the server into issuing arbitrary outbound HTTP requests. The attack is remotely exploitable over the network, requires no authentication, and public exploit details are available. The upstream project received an early issue report but has not yet responded.
Critical Impact
Unauthenticated remote attackers can abuse the invoice renderer to probe internal networks, reach cloud metadata endpoints, or fetch attacker-controlled content through the vulnerable server.
Affected Products
- vas3k TaxHacker versions up to and including 0.8.5
- Component: Invoice PDF Renderer
- Affected file: /apps/invoices/actions.ts
Discovery Timeline
- 2026-09-20 - CVE-2026-94039 published to NVD
- 2026-09-21 - Last updated in NVD database
Technical Details for CVE-2026-94039
Vulnerability Analysis
The vulnerability lives in the generateInvoicePDF function of TaxHacker's Invoice PDF Renderer. When generating an invoice PDF, the renderer fetches the image referenced by the businessLogo argument and embeds it in the document. The application does not validate the supplied URL against an allowlist, block internal address ranges, or restrict URL schemes. An attacker who can supply a businessLogo value causes the server to perform an outbound request to any destination of their choice.
SSRF in a PDF rendering path is particularly useful to attackers because responses are often reflected back inside the generated PDF or trigger observable side effects. Attackers can enumerate internal services, reach cloud provider instance metadata services, or interact with unauthenticated internal APIs from the server's trusted network position.
Root Cause
The root cause is missing input validation on a user-controlled URL parameter [CWE-918]. The businessLogo value is passed to an HTTP client without scheme filtering, DNS resolution checks, or destination allowlisting. Any string parseable as a URL becomes a server-issued request.
Attack Vector
Exploitation is remote and requires no privileges or user interaction. An attacker submits an invoice generation request containing a crafted businessLogo URL pointing to an internal host, a link-local metadata endpoint such as 169.254.169.254, or an attacker-controlled listener. The TaxHacker backend fetches the URL from its own network context and processes the response as image data. Refer to the VulDB entry for CVE-2026-94039 and GitHub Issue #186 for public technical details.
Detection Methods for CVE-2026-94039
Indicators of Compromise
- Outbound HTTP or HTTPS requests from the TaxHacker application server to RFC1918 addresses, 127.0.0.0/8, or link-local ranges such as 169.254.169.254.
- Invoice generation requests containing businessLogo values with non-standard schemes (file://, gopher://) or unexpected hostnames.
- Application logs showing repeated generateInvoicePDF invocations from a single source with varied businessLogo targets.
- Unexplained DNS lookups originating from the TaxHacker host to attacker-controlled domains.
Detection Strategies
- Instrument the TaxHacker container or host with egress logging and alert on connections to internal ranges or cloud metadata IPs.
- Deploy a web application firewall rule inspecting invoice endpoints for businessLogo payloads referencing private address space.
- Correlate PDF generation events with outbound network flows to identify anomalous request patterns.
Monitoring Recommendations
- Enable full request logging on the invoice creation endpoint, including submitted URL parameters.
- Monitor egress traffic from the application server using a network detection tool and baseline expected destinations.
- Track cloud provider metadata endpoint access from workloads that should never contact it.
How to Mitigate CVE-2026-94039
Immediate Actions Required
- Restrict outbound network access from the TaxHacker application to only the domains required for legitimate operation.
- Block the application host from reaching internal management networks and cloud metadata IP addresses at the network layer.
- Audit recent invoice generation logs for suspicious businessLogo values referencing internal or unexpected hosts.
- Consider temporarily disabling user-supplied logo functionality until an upstream fix is available.
Patch Information
As of the CVE publication, the vas3k TaxHacker project has not responded to the issue report and no official patch is available. Track the TaxHacker repository and GitHub Issue #186 for remediation progress. Users should validate any future release notes for fixes to the generateInvoicePDF function in /apps/invoices/actions.ts.
Workarounds
- Deploy a reverse proxy or egress firewall that permits only allowlisted image hosting domains from the TaxHacker server.
- Enforce a URL validation layer in front of the application that rejects non-HTTPS schemes and private IP ranges before requests reach generateInvoicePDF.
- Run TaxHacker in a network segment with no route to internal services or cloud metadata endpoints.
- Require pre-uploaded logo files rather than remote URLs by disabling the businessLogo remote fetch code path in deployments where source modification is feasible.
# Example iptables egress restriction blocking common SSRF targets
iptables -A OUTPUT -d 169.254.169.254 -j DROP
iptables -A OUTPUT -d 10.0.0.0/8 -j DROP
iptables -A OUTPUT -d 172.16.0.0/12 -j DROP
iptables -A OUTPUT -d 192.168.0.0/16 -j DROP
iptables -A OUTPUT -d 127.0.0.0/8 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
