CVE-2026-94039

Name of the Vulnerable Software and Affected Versions vas3k TaxHacker versions prior to 0.8.6

Description An issue exists in the Invoice PDF Renderer component within the generateInvoicePDF() function located in the /apps/invoices/actions.ts file. A remote attacker can perform server-side request forgery (SSRF)—a technique that allows an attacker to induce the server-side application to make requests to an unintended location—by manipulating the businessLogo argument.

Recommendations As a temporary workaround, restrict the use of the businessLogo argument within the generateInvoicePDF() function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.