InvoiceShelf EUVD-2026-101612

Requires owner/administrator access to InvoiceShelf's PDF configuration to set the gotenberg_host value (hence PR:H), and the instance must use the Gotenberg PDF driver so that GotenbergPDFDriver::loadView dispatches the multipart render request. Pre-patch (versions before 2.4.0), the gotenberg_host is validated only as a syntactically valid URL with no check that resolved IPs are public, so loopback, private (RFC1918), link-local/cloud-metadata (169.254.169.254), CGNAT, and reserved ranges are all reachable. Exploitation is LIMITED by: the owner-level privilege needed to change the setting, the requirement that a PDF (invoice, estimate, or payment) actually be rendered to fire the request, and deployment in an environment where internal services or a cloud metadata endpoint are network-reachable from the server. The 2.4.0 fix adds SafeRemoteUrl validation at both request time and render time (defending against env/seed/stale config and DNS rebinding).

This is a moderate, privilege-gated SSRF (CWE-918) rather than a widespread emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N = 6.8) is internally consistent with the description: network-reachable, low complexity, but requiring PR:H because the exploitable gotenberg_host setting is owner/administrator-controlled configuration. The scope change (S:C) and C:H are justified because a malicious or attacker-influenced host value makes the server reach internal services and cloud metadata endpoints and exfiltrate customer PII/invoice data to an external host - impact crosses a trust boundary. No EPSS score, KEV listing, or POC indicator is present in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The practical risk is bounded by the PR:H requirement: an attacker must already hold owner-level control of the PDF configuration (or leverage env/seed/stale config, or DNS rebinding, which the vendor's defense-in-depth patch explicitly addresses). Net: a legitimate priority for self-hosted InvoiceShelf operators in multi-tenant or cloud-metadata-exposed environments, but not a mass-exploitation threat given the authentication barrier and niche product footprint.

An authenticated InvoiceShelf owner sets the gotenberg_host PDF setting to a URL whose host resolves to an internal address (e.g. 169.254.169.254 or an RFC1918 service), which passes the pre-patch syntactic-URL-only validation. On the next invoice, estimate, or payment PDF render, the server sends a multipart HTTP request to that host, allowing reconnaissance of internal services or capture of cloud metadata, and leaking customer names, addresses, line items, totals, and company identifiers to an attacker-chosen external endpoint. No public exploit code is identified in the provided data.