PT-2026-1550 · Unknown · Invoice Ninja

Gets · Published 2026-01-07 · Updated 2026-01-07 · CVE-2026-0649

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:L/Au:M/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions invoiceninja versions prior to 5.12.38

Description A security issue exists in invoiceninja. The issue involves server-side request forgery (SSRF) stemming from manipulation of the company logo argument within the copy function of the /app/Jobs/Util/Import.php file, part of the Migration Import component. This allows for remote exploitation. The details of the issue have been publicly disclosed.

Recommendations Update invoiceninja to version 5.12.38 or later.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-0649

Affected Products

Invoice Ninja

References · 8

• 🔥 https://note-hxlab.wetolink.com/share/fWqEpn5fX4rH · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-0649 · Security Note
• https://vuldb.com/?submit.721323 · Note
• https://twitter.com/CVEnew/status/2008771287628513477 · Twitter Post
• https://t.me/CVEtracker/41552 · Telegram Post
• https://vuldb.com/?ctiid.339720 · Note
• https://vuldb.com/?id.339720 · Note
• https://twitter.com/VulmonFeeds/status/2008957982667616480 · Twitter Post