CVE-2026-55385 InvoiceShelf: SSRF via unvalidated Gotenberg PDF renderer host in PDF configuration

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf's PDFConfigurationRequest.php validates the owner-controlled gotenberghost setting only as a syntactically valid URL...

CVE-2026-55385

The InvoiceShelf web and mobile application is vulnerable to Server-Side Request Forgery (SSRF) in versions prior to 2.4.0 . The root cause lies in PDFConfigurationRequest.php, which only performs syntactic validation on the owner-controlled gotenberg_host setting. Consequently, GotenbergPDFDrive...

CVE-2026-55385 InvoiceShelf: SSRF via unvalidated Gotenberg PDF renderer host in PDF configuration

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf's PDFConfigurationRequest.php validates the owner-controlled gotenberghost setting only as a syntactically valid URL...

CVE-2026-55385 InvoiceShelf: SSRF via unvalidated Gotenberg PDF renderer host in PDF configuration

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf's PDFConfigurationRequest.php validates the owner-controlled gotenberghost setting only as a syntactically valid URL...