CVE-2026-94039 | vas3k TaxHacker up to 0.8.5 Invoice PDF Renderer actions.ts generateInvoicePDF businessLogo server-side request forgery (Issue 186)

September 19, 2026 Yanac

A vulnerability was found in vas3k TaxHacker up to 0.8.5. It has been rated as critical. Affected is the function generateInvoicePDF of the file /apps/invoices/actions.ts of the component Invoice PDF Renderer. Performing a manipulation of the argument businessLogo results in server-side request forgery.

This vulnerability is reported as CVE-2026-94039. The attack is possible to be carried out remotely. Moreover, an exploit is present.

The project was informed of the problem early through an issue report but has not responded yet.VulDB Recent EntriesRead More