Skip to content
CVE PROGRAM SOURCE RECORD7.7 High

CVE-2025-0474

Invoice Ninja PDF Rendering Server Side Request Forgery

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

Invoice Ninja is vulnerable to authenticated Server-Side Request Forgery (SSRF) allowing for arbitrary file read and network resource requests as the application user. This issue affects Invoice Ninja: from 5.8.56 through 5.11.23.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Invoice Ninja Invoice Ninja

Default version status: unknown

  • 5.8.56 to ≤ 5.11.23affected
pkg:github/invoiceninja/invoiceninja

References