A Server‑Side Request Forgery vulnerability allows an attacker to trick the PDF rendering library into fetching arbitrary remote resources. The flaw stems from user‑supplied HTML in the payment Notes field being passed unchanged to the Dompdf library, which can resolve external URLs and perform requests on behalf of the server. The weakness is identified as CWE‑918. This results in the ability to access internal network services, exfiltrate data, or trigger internal actions without authentication to the vulnerable endpoint.

The issue affects the open‑source InvoiceShelf application before version 2.2.0. All installations running any release prior to 2.2.0 are vulnerable. Version 2.2.0, released in the mentioned tag, includes the fix.

The CVSS score of 7.6 indicates a high impact potential. The EPSS percentage is below 1%, suggesting low current exploitation likelihood, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is direct; an adversary can submit a malicious Notes field and trigger the PDF receipt endpoint to perform SSRF without needing any additional privileges. No specific user authentication is required to exploit the flaw beyond creating a payment record.