EUVD-2026-83758
GHSA-gc9f-gc68-qrg3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to TaxHacker instance
-
DeliverySet businessLogo to internal/metadata URL
-
ExploitTrigger generateInvoicePDF rendering
-
ExecutionServer fetches attacker URL (SSRF)
-
ImpactReach internal services / read limited responses
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service URL allowlisting, SSRF prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires reaching the invoice PDF generation path where the businessLogo argument is attacker-controllable - i.e., an account/session on the self-hosted TaxHacker instance able to configure business branding and generate an invoice. The server-side PDF renderer must fetch the supplied logo URL for the SSRF to fire. Limiting factors: the app is a self-hosted, single-tenant OSS tool with a small footprint, impact is limited (only Low confidentiality/integrity/availability per the vector - no code execution), and realistic exploitation presumes an authenticated user rather than a fully anonymous internet attacker despite the vendor's PR:N rating. |
| Impact | This is a moderate-severity SSRF (CWE-918) in TaxHacker, a niche self-hosted open-source accounting/invoicing app. The vendor CVSS 4.0 score of 6.9 (AV:N/AC:L/PR:N/UI:N/VC:L/VI:L/VA:L, E:P) is inflated by the PR:N assumption and network reach; the actual damage metrics are all 'Low', reflecting limited-impact SSRF rather than RCE or full data disclosure. I dispute PR:N - manipulating the businessLogo argument that feeds generateInvoicePDF realistically requires an authenticated account able to configure business/invoice settings, so PR:L is more honest (my CVSS 3.1 ~4.3). POC exploit code is publicly available (GitHub issue #186), so exploitability is confirmed, but there is no EPSS score and no CISA KEV listing in the provided data, and the exploitation status is 'publicly available exploit code exists' - NOT active exploitation. Net: this is a real but low-priority issue given the obscure product, low technical impact, and the fact that the project has not yet responded to or patched the report. |
| Exploit ScenarioDerived | An attacker with access to the invoice/business-settings feature sets the businessLogo value to an internal URL (e.g., a cloud metadata endpoint or an internal service). When the PDF renderer generates an invoice, the server fetches that attacker-controlled URL, letting the attacker probe or reach internal network resources. Public exploit code exists in the project's GitHub issue #186, lowering the barrier to reproduction. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 20, 2026
Server-side request forgery in vas3k TaxHacker up to 0.8.5 lets an attacker control the businessLogo argument passed to the generateInvoicePDF function in /apps/invoices/actions.ts and force the server-side invoice PDF renderer to fetch an arbitrary URL. The independent assessment rates this as moderate severity (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), with exploitation requiring an account on the self-hosted instance that can configure business branding and trigger invoice generation, rather than an anonymous internet attacker. Publicly available exploit code exists, the issue was reported to the project early via GitHub issue #186 without a vendor response, and no CISA KEV listing was identified - impact is limited to low confidentiality, integrity, and availability with no code execution.
RemediationAI
No vendor-released patch identified at time of analysis - the project was notified early via GitHub issue #186 (https://github.com/vas3k/TaxHacker/issues/186) and has not responded, so the only durable fix is to track the repository (https://github.com/vas3k/TaxHacker/) and the VulDB record (https://vuldb.com/vuln/407968) for a commit or release above 0.8.5 that validates or allowlists the businessLogo URL, and to treat any such commit as the interim patch. Until then, apply compensating controls with their trade-offs: restrict who can configure business branding and generate invoices to trusted administrators only, since the SSRF requires control of the businessLogo argument (this removes the attack path but narrows normal workflow for multi-user instances); enforce egress filtering from the TaxHacker host or container so it cannot reach RFC1918 ranges, loopback, and the cloud metadata address 169.254.169.254 - ideally via a default-deny egress policy with an allowlist of legitimate logo/asset CDNs (this may break invoice generation when logos are hosted on internal or unlisted hosts, and will not stop SSRF to hosts already on the allowlist); if using a cloud deployment, enforce IMDSv2 with a low hop limit and restrict the instance role's permissions so a successful metadata fetch yields nothing useful; and run the application in an isolated network segment with no reachability to internal admin planes or databases. Given that publicly available exploit code exists, prioritize these mitigations on any instance where untrusted or semi-trusted users can configure branding, and monitor outbound HTTP from the TaxHacker process for requests to internal IP literals as a detection signal.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This is a classic server-side request forgery (CWE-918) in which user-controllable input is used as a URL that the server itself dereferences. In TaxHacker, the invoice PDF rendering path (generateInvoicePDF in /apps/invoices/actions.ts) accepts a businessLogo value that the application passes to the PDF renderer, which then performs an outbound HTTP fetch to retrieve the image for embedding in the generated invoice. Because the URL is not validated against an allowlist or blocked against internal address ranges, an attacker who can set the business logo can direct that fetch at arbitrary hosts - internal network services, localhost-bound admin interfaces, or cloud instance metadata endpoints. The component is described as an Invoice PDF Renderer and the affected artifact is the vas3k/taxhacker open-source project (CPE cpe:2.3:a:vas3k:taxhacker:*), a self-hosted, single-tenant accounting/invoicing application; the assessed vector indicates no scope change and only low-level C/I/A impact, consistent with an information-disclosure/request-oracle style SSRF rather than a pivot to code execution.
Know when Taxhacker gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Setting businessLogo requires an authenticated user (PR:L); SSRF yields limited internal-response disclosure (C:L) with no meaningful integrity/availability impact and no scope change.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was detected in vas3k TaxHacker up to 0.8.5. Affected is the function generateInvoicePDF of the file /apps/invoices/actions.ts of the component Invoice PDF Renderer. Performing a manipulation of the argument businessLogo results in server-side request forgery. The attack is possible to be carried out remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
Server-side request forgery in vas3k TaxHacker up to and including 0.8.5 lets an attacker who can reach the LLM-provider
Authentication bypass in vas3k TaxHacker through version 0.8.2 is possible because the JWT Secret Handler in `lib/config
Server-side request forgery in vas3k TaxHacker up to version 0.8.2 enables authenticated remote attackers to force the a
Exploit-DB