Description
A security vulnerability has been detected in invoiceninja Invoice Ninja up to 5.13.26. This vulnerability affects the function Purify::isHostSafe of the file app/Services/Pdf/Purify.php of the component invoices Endpoint. The manipulation of the argument notes leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-09-01
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Invoice Ninja up to version 5.13.26 contains a server‑side request forgery flaw in the Purify::isHostSafe function of the invoices endpoint. By manipulating the notes argument, a remote attacker can cause the application to send HTTP requests to arbitrary internal hosts, potentially exposing sensitive services or facilitating further attacks. The vulnerability corresponds to CWE‑918.

Affected Systems

The flaw affects the Invoice Ninja product from the invoiceninja vendor, specifically all releases up to and including 5.13.26. Any deployment using these versions should be considered exposed until a patch is applied.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity. Although EPSS data is unavailable, the existence of a publicly disclosed exploit and the ability to trigger the flaw remotely increase the practical risk. The vulnerability is not yet listed in the CISA KEV catalog, but the remote SSRF capability warrants immediate attention and mitigation.

Generated by OpenCVE AI on September 1, 2026 at 06:22 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Invoice Ninja to version 5.13.27 or later where the SSRF issue is fixed.
  • If an immediate upgrade is not possible, restrict access to the invoices endpoint and remove the ability to supply arbitrary URLs in the notes field.
  • Implement a web application firewall rule or outbound proxy restriction that blocks requests originating from the PDF rendering service to internal IP ranges or disallows disallowed URI schemes.

Generated by OpenCVE AI on September 1, 2026 at 06:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 01 Sep 2026 05:15:00 +0000

Type Values Removed Values Added
Description A security vulnerability has been detected in invoiceninja Invoice Ninja up to 5.13.26. This vulnerability affects the function Purify::isHostSafe of the file app/Services/Pdf/Purify.php of the component invoices Endpoint. The manipulation of the argument notes leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title invoiceninja Invoice Ninja invoices Endpoint Purify.php isHostSafe server-side request forgery
First Time appeared Invoiceninja
Invoiceninja invoice Ninja
Weaknesses CWE-918
CPEs cpe:2.3:a:invoiceninja:invoice_ninja:*:*:*:*:*:*:*:*
Vendors & Products Invoiceninja
Invoiceninja invoice Ninja
References
Metrics cvssV2_0

{'score': 4, 'vector': 'AV:N/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 4.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Invoiceninja Invoice Ninja
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-01T05:00:12.817Z

Reserved: 2026-08-31T22:52:25.114Z

Link: CVE-2026-83744

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-01T05:17:10.803

Modified: 2026-09-01T05:17:10.803

Link: CVE-2026-83744

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-01T06:30:11Z

Weaknesses
  • CWE-918

    Server-Side Request Forgery (SSRF)