HIGH

CVE-2026-94039

2026-09-20 CVSS v3.1

CVSS

7.3

Description

A vulnerability was detected in vas3k TaxHacker up to 0.8.5. Affected is the function generateInvoicePDF of the file /apps/invoices/actions.ts of the component Invoice PDF Renderer. Performing a manipulation of the argument businessLogo results in server-side request forgery. The attack is possible to be carried out remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Weakness (CWE)

CWE-918 Server-Side Request Forgery (SSRF)

References

https://github.com/vas3k/TaxHacker/ https://github.com/vas3k/TaxHacker/issues/186 https://vuldb.com/cve/CVE-2026-94039 https://vuldb.com/submit/947878 https://vuldb.com/vuln/407968 https://vuldb.com/vuln/407968/cti

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE