CVE-2026-83744

Name of the Vulnerable Software and Affected Versions Invoice Ninja versions prior to 5.13.27

Description An issue exists in the Purify::isHostSafe() function within the app/Services/Pdf/Purify.php file of the invoices endpoint. A remote attacker can manipulate the notes argument to perform server-side request forgery (SSRF), a technique where the server is coerced into making unauthorized requests to internal or external resources.

Recommendations Update Invoice Ninja to version 5.13.27 or later. As a temporary mitigation, restrict or sanitize the input provided to the notes argument in the invoices endpoint.