CVE-2026-55385

Name of the Vulnerable Software and Affected Versions InvoiceShelf versions prior to 2.4.0

Description In PDFConfigurationRequest.php, the gotenberg host setting is only validated as a syntactically valid URL. Subsequently, the loadView() function in GotenbergPDFDriver sends a multipart HTTP request containing rendered HTML for invoices, estimates, or payments as document.html to the specified host. Because the application does not reject private, loopback, link-local, or reserved addresses, an owner can use PDF generation to access internal services or cloud metadata endpoints. Additionally, a configured external host may receive sensitive data, including customer names, addresses, line items, totals, and company identifiers, during subsequent PDF renders.

Recommendations Update to version 2.4.0.