PT-2026-29095 · Unknown · Invoice Ninja

Treklaps · CVE-2026-29925 · Published 2026-03-30 · Updated 2026-03-30

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Invoice Ninja versions 5.12.46 and 5.12.48

Description Invoice Ninja versions 5.12.46 and 5.12.48 are susceptible to a Server-Side Request Forgery (SSRF) condition. This issue is located in the CheckDatabaseRequest.php file. SSRF occurs when an application makes requests to unintended locations, potentially exposing sensitive data or allowing unauthorized actions.

Recommendations Update Invoice Ninja to a version newer than 5.12.48. Update Invoice Ninja to a version newer than 5.12.46.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-29925

Affected Products

Invoice Ninja

References · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29925.json · Exploit
• 🔥 https://gist.github.com/TrekLaps/5b2c72106d950dab0cd1897eb93200f1 · Exploit
• https://osv.dev/vulnerability/CVE-2026-29925 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-29925 · Security Note
• https://github.com/invoiceninja/invoiceninja/blob/v5-stable/app/Http/Requests/Setup/CheckDatabaseRequest.php · Note