InvoiceShelf's PDF generation feature uses Gotenberg to render documents. The configuration parameter for the Gotenberg host is only checked for syntactic URL validity and is not validated against private, loopback, or reserved IP ranges. An application owner can supply any URL, allowing the server to issue HTTP requests to arbitrary internal or external addresses during PDF rendering. This enables the attacker to trigger sensitive endpoints such as cloud metadata services or internal APIs, and the rendered PDF may expose customer details, invoices, and company identifiers. The vulnerability is a classic Server Side Request Forgery identified as CWE‑918.

All InvoiceShelf installations running before version 2.4.0 are affected, regardless of deployment size, because the owner‑controlled gotenberg_host configuration is unchecked before the PDF rendering stage. The flaw exists in the InvoiceShelf project under the path PDFConfigurationRequest.php and the GotenbergPDFDriver::loadView logic. Any user with ownership or administrative rights who can trigger PDF creation—such as generating invoices, estimates, or payments—can exploit the flaw.

The CVSS score for this issue is 6.8, indicating a moderate risk level. EPSS data is not available, so the likelihood of exploitation in the wild cannot be quantified from the dataset. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves the web application, specifically the PDF generation API, where an authenticated owner passes a malicious URL. If exploited, the attacker can reach internal network resources or public cloud metadata endpoints and obtain confidential data without needing privileged network access.