SSRF Vulnerability in vas3k TaxHacker via Invoice PDF Renderer

A server-side request forgery (SSRF) vulnerability, assigned CVE-2026-94039, has been identified in the TaxHacker application developed by vas3k in versions up to 0.8.5. The flaw is located within the generateInvoicePDF function inside the /apps/invoices/actions.ts file, specifically within the Invoice PDF Renderer component. An unauthenticated remote attacker can trigger the vulnerability by providing a crafted value to the businessLogo argument during the PDF generation process. Successful exploitation allows the application server to perform unauthorized outbound HTTP requests, potentially exposing internal network resources or metadata services. As of the report date, the vulnerability remains unpatched and is publicly disclosed, increasing the likelihood of exploitation attempts.

Impact

Successful exploitation allows remote attackers to bypass network access controls, perform reconnaissance of internal infrastructure, or potentially access sensitive internal metadata and services reachable by the server. This vulnerability is applicable to any deployment of TaxHacker up to version 0.8.5.

Recommendation

Detection engineering teams should monitor web access logs for suspicious input patterns directed at the invoice generation endpoint. Due to the lack of a vendor patch, network-level egress filtering is the most effective mitigation strategy for internal resources.