A Server‑Side Request Forgery flaw exists in the PDF generation path of InvoiceShelf’s estimating module. User input placed in the Notes field is passed directly to the Dompdf rendering library without HTML sanitisation, allowing an attacker to embed arbitrary URLs in the note. When the PDF is rendered, Dompdf will fetch the referenced remote resource, causing the application server to make outbound requests on the attacker’s behalf. This behaviour can expose internal network services, leak sensitive data, or serve as a stepping‑stone to further exploitation. The vulnerability is scored as CVSS 7.6, indicating high severity.

All releases of InvoiceShelf prior to version 2.2.0 are vulnerable. The fix is available in release 2.2.0 and later. The product is an open‑source web and mobile application used for managing invoices and estimates.

The flaw is highly relevant to attackers who can create or edit estimates with custom Notes. Exploitation requires access to the PDF preview or customer view endpoints, which are normally protected by authentication. While the EPSS score is below 1%, signalling a relatively low current exploit probability, the CVSS rating and lack of mitigations mean the vulnerability poses a real risk if left unpatched. It is not present in the CISA KEV catalogue. Attackers would typically learn the vulnerable endpoint by browsing the application, then inject a malicious URL in the Notes field to force the server to fetch internal or external content.