Description
A security vulnerability has been detected in invoiceninja Invoice Ninja up to 5.13.26. This vulnerability affects the function Purify::isHostSafe of the file app/Services/Pdf/Purify.php of the component invoices Endpoint. The manipulation of the argument notes leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-09-01
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 01 Sep 2026 05:15:00 +0000

Type Values Removed Values Added
Description A security vulnerability has been detected in invoiceninja Invoice Ninja up to 5.13.26. This vulnerability affects the function Purify::isHostSafe of the file app/Services/Pdf/Purify.php of the component invoices Endpoint. The manipulation of the argument notes leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title invoiceninja Invoice Ninja invoices Endpoint Purify.php isHostSafe server-side request forgery
First Time appeared Invoiceninja
Invoiceninja invoice Ninja
Weaknesses CWE-918
CPEs cpe:2.3:a:invoiceninja:invoice_ninja:*:*:*:*:*:*:*:*
Vendors & Products Invoiceninja
Invoiceninja invoice Ninja
References
Metrics cvssV2_0

{'score': 4, 'vector': 'AV:N/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 4.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Invoiceninja Invoice Ninja
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-01T05:00:12.817Z

Reserved: 2026-08-31T22:52:25.114Z

Link: CVE-2026-83744

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-01T05:17:10.803

Modified: 2026-09-01T05:17:10.803

Link: CVE-2026-83744

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-01T09:00:11Z

Weaknesses
  • CWE-918

    Server-Side Request Forgery (SSRF)