PT-2026-29342 · Unknown+1 · Invoiceshelf+1

Lagongit · Published 2026-03-31 · Updated 2026-04-01 · CVE-2026-34366

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions InvoiceShelf versions prior to 2.2.0

Description InvoiceShelf is a web and mobile application used for expense tracking, payments, and invoice/estimate creation. A Server-Side Request Forgery (SSRF) exists in the Payment receipt PDF generation module in versions prior to 2.2.0. User-supplied HTML within the payment Notes field is passed without sanitization to the Dompdf rendering library, allowing it to fetch remote resources referenced in the markup. The vulnerability is exploitable through the PDF receipt endpoint, regardless of email attachment settings.

Recommendations Update to version 2.2.0 or later.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-34366

GHSA-38HF-FQ8X-Q49R

Affected Products

Dompdf

Invoiceshelf

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34366.json · Exploit
• https://github.com/InvoiceShelf/InvoiceShelf/security/advisories/GHSA-38hf-fq8x-q49r · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34366 · Security Note
• https://osv.dev/vulnerability/CVE-2026-34366 · Vendor Advisory
• https://github.com/InvoiceShelf/InvoiceShelf/releases/tag/2.2.0 · Note
• https://twitter.com/infoflowcloud/status/2039373757291065400 · Twitter Post
• https://twitter.com/CVEnew/status/2039372143616475276 · Twitter Post