CVE-2026-0649

invoiceninja Migration Import Import.php copy server-side request forgery

View on CVE.org
Published Jan 7, 2026 CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Description
A security vulnerability has been detected in invoiceninja up to 5.12.38. The affected element is the function copy of the file /app/Jobs/Util/Import.php of the component Migration Import. The manipulation of the argument company_logo leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Analysis

AI-generated

Technical impact

The vulnerability resides in the copy method of /app/Jobs/Util/Import.php, part of the Migration Import component. By manipulating the company_logo argument, an attacker can cause the server to perform HTTP requests to arbitrary destinations. This type of server‑side request forgery enables a remote actor to reach internal services, discover network topology, or exfiltrate data, thereby compromising confidentiality and availability of internal resources. The weakness is identified as a classic input validation flaw (CWE‑918).

Affected Systems

Any instance of InvoiceNinja up to version 5.12.38 is affected, regardless of deployment environment. The flaw exists in the core migration import functionality and is not limited to a specific module or plug‑in. Administrators should verify that their deployment is running a version earlier than 5.12.39 and consider upgrading to the most recent release when a fix is available.

Risk and Exploitability

The CVSS score is 5.1, indicating moderate risk. EPSS is reported as less than 1 %, implying that the likelihood of exploitation is currently low, though the vulnerability is publicly disclosed and could be abused if the vulnerability remains unpatched. The vulnerability is not listed in CISA’s KEV catalog. The attack can be performed remotely by submitting a crafted company_logo value to the import endpoint, making the server fetch arbitrary URLs. The lack of an official patch or workaround from the vendor demonstrates the criticality of addressing the flaw immediately or mitigating through defensive controls.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade InvoiceNinja to the latest release once a patch for the SSRF issue is made available.
  • Implement input validation on the company_logo parameter, for example, allow only safe protocols such as https and filter out or block internal IP ranges and file:// schemes.
  • Deploy web application firewall rules or reverse‑proxy checks that detect and block outbound requests originating from the import endpoint, thereby mitigating potential SSRF traffic until a host‑side fix is applied.

Generated by OpenCVE AI on April 18, 2026 at 16:54 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Invoiceninja
Invoiceninja migration Import
Vendors & Products Invoiceninja
Invoiceninja migration Import
Type Values Removed Values Added
Description A security vulnerability has been detected in invoiceninja up to 5.12.38. The affected element is the function copy of the file /app/Jobs/Util/Import.php of the component Migration Import. The manipulation of the argument company_logo leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title invoiceninja Migration Import Import.php copy server-side request forgery
Weaknesses CWE-918
References
Metrics cvssV2_0

{'score': 5.8, 'vector': 'AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 4.7, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 4.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-918

    Server-Side Request Forgery (SSRF)

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Feb 23, 2026, 8:22 AM
Reserved
Jan 6, 2026, 4:20 PM

View source JSON

Updated
Jan 7, 2026, 2:28 PM

JSON

Status
Deferred
Published
Jan 7, 2026, 12:17 PM
Modified
Jun 17, 2026, 10:11 AM

View source JSON

No data.

Updated
Apr 18, 2026, 5:00 PM

JSON