The vulnerability resides in the copy method of /app/Jobs/Util/Import.php, part of the Migration Import component. By manipulating the company_logo argument, an attacker can cause the server to perform HTTP requests to arbitrary destinations. This type of server‑side request forgery enables a remote actor to reach internal services, discover network topology, or exfiltrate data, thereby compromising confidentiality and availability of internal resources. The weakness is identified as a classic input validation flaw (CWE‑918).

Any instance of InvoiceNinja up to version 5.12.38 is affected, regardless of deployment environment. The flaw exists in the core migration import functionality and is not limited to a specific module or plug‑in. Administrators should verify that their deployment is running a version earlier than 5.12.39 and consider upgrading to the most recent release when a fix is available.

The CVSS score is 5.1, indicating moderate risk. EPSS is reported as less than 1 %, implying that the likelihood of exploitation is currently low, though the vulnerability is publicly disclosed and could be abused if the vulnerability remains unpatched. The vulnerability is not listed in CISA’s KEV catalog. The attack can be performed remotely by submitting a crafted company_logo value to the import endpoint, making the server fetch arbitrary URLs. The lack of an official patch or workaround from the vendor demonstrates the criticality of addressing the flaw immediately or mitigating through defensive controls.