CVE-2026-34365 — InvoiceShelf is an open-source web & mobile app that helps track expenses,…
Image via opengraph.githubassets.com
🚨 CVE-2026-34365 InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.2.0, a Server-Side Request Forgery (SSRF) vulnerability exists in the Estimate PDF generation module.
Release v2.2.0 · InvoiceShelf/InvoiceShelf
github.com
What This Means For You
- New vulnerability disclosed — verify if your stack is exposed.
Related ATT&CK Techniques
Indicators of Compromise
| ID | Type | Indicator |
|---|---|---|
| CVE-2026-34365 | SSRF | InvoiceShelf version prior to 2.2.0, Estimate PDF generation module, user-supplied HTML in estimate Notes field unsanitised to Dompdf rendering library, exploitable via PDF preview and customer view endpoints. |
🛠 Recommended Tools
🤖
SCW Elite Bot
Get IOC packs, detection rules & premium threat intel — pay with Telegram Stars ⭐
Open Bot →
Source & Attribution
| Source Platform | Telegram |
| Channel | CVE Notify |
| Channel ID | 1129491012 |
| Message ID | 158297 |
| Published | April 07, 2026 at 18:56 UTC |
| Original Link | https://github.com/InvoiceShelf/InvoiceShelf/releases/tag... |
This content was curated and summarized by Shimi's Cyber World for informational purposes. It is not copied or republished in full. All intellectual property rights remain with the original author and source.
Believe this infringes your rights? Submit a takedown request.
Found this interesting? Follow us to stay ahead.
Share