CVE-2026-0649

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-0649", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-01-06T16:20:31.689Z", "datePublished": "2026-01-07T00:32:07.531Z", "dateUpdated": "2026-02-23T08:22:03.166Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-02-23T08:22:03.166Z"}, "title": "invoiceninja Migration Import Import.php copy server-side request forgery", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-918", "lang": "en", "description": "Server-Side Request Forgery"}]}], "affected": [{"vendor": "n/a", "product": "invoiceninja", "versions": [{"version": "5.12.0", "status": "affected"}, {"version": "5.12.1", "status": "affected"}, {"version": "5.12.2", "status": "affected"}, {"version": "5.12.3", "status": "affected"}, {"version": "5.12.4", "status": "affected"}, {"version": "5.12.5", "status": "affected"}, {"version": "5.12.6", "status": "affected"}, {"version": "5.12.7", "status": "affected"}, {"version": "5.12.8", "status": "affected"}, {"version": "5.12.9", "status": "affected"}, {"version": "5.12.10", "status": "affected"}, {"version": "5.12.11", "status": "affected"}, {"version": "5.12.12", "status": "affected"}, {"version": "5.12.13", "status": "affected"}, {"version": "5.12.14", "status": "affected"}, {"version": "5.12.15", "status": "affected"}, {"version": "5.12.16", "status": "affected"}, {"version": "5.12.17", "status": "affected"}, {"version": "5.12.18", "status": "affected"}, {"version": "5.12.19", "status": "affected"}, {"version": "5.12.20", "status": "affected"}, {"version": "5.12.21", "status": "affected"}, {"version": "5.12.22", "status": "affected"}, {"version": "5.12.23", "status": "affected"}, {"version": "5.12.24", "status": "affected"}, {"version": "5.12.25", "status": "affected"}, {"version": "5.12.26", "status": "affected"}, {"version": "5.12.27", "status": "affected"}, {"version": "5.12.28", "status": "affected"}, {"version": "5.12.29", "status": "affected"}, {"version": "5.12.30", "status": "affected"}, {"version": "5.12.31", "status": "affected"}, {"version": "5.12.32", "status": "affected"}, {"version": "5.12.33", "status": "affected"}, {"version": "5.12.34", "status": "affected"}, {"version": "5.12.35", "status": "affected"}, {"version": "5.12.36", "status": "affected"}, {"version": "5.12.37", "status": "affected"}, {"version": "5.12.38", "status": "affected"}], "modules": ["Migration Import"]}], "descriptions": [{"lang": "en", "value": "A security vulnerability has been detected in invoiceninja up to 5.12.38. The affected element is the function copy of the file /app/Jobs/Util/Import.php of the component Migration Import. The manipulation of the argument company_logo leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.1, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 4.7, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 4.7, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 5.8, "vectorString": "AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-01-06T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-01-06T01:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-01-08T10:11:19.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "gets (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/?id.339720", "name": "VDB-339720 | invoiceninja Migration Import Import.php copy server-side request forgery", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.339720", "name": "VDB-339720 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.721323", "name": "Submit #721323 | invoiceninja <= 5.12.38. ssrf", "tags": ["third-party-advisory"]}, {"url": "https://note-hxlab.wetolink.com/share/fWqEpn5fX4rH", "tags": ["exploit"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-07T14:27:52.863067Z", "id": "CVE-2026-0649", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-07T14:28:45.081Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-0649", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-07T14:27:52.863067Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-07T14:28:36.816Z"}}], "cna": {"title": "invoiceninja Migration Import Import.php copy server-side request forgery", "credits": [{"lang": "en", "type": "reporter", "value": "gets (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 4.7, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 4.7, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 5.8, "vectorString": "AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "affected": [{"vendor": "n/a", "modules": ["Migration Import"], "product": "invoiceninja", "versions": [{"status": "affected", "version": "5.12.0"}, {"status": "affected", "version": "5.12.1"}, {"status": "affected", "version": "5.12.2"}, {"status": "affected", "version": "5.12.3"}, {"status": "affected", "version": "5.12.4"}, {"status": "affected", "version": "5.12.5"}, {"status": "affected", "version": "5.12.6"}, {"status": "affected", "version": "5.12.7"}, {"status": "affected", "version": "5.12.8"}, {"status": "affected", "version": "5.12.9"}, {"status": "affected", "version": "5.12.10"}, {"status": "affected", "version": "5.12.11"}, {"status": "affected", "version": "5.12.12"}, {"status": "affected", "version": "5.12.13"}, {"status": "affected", "version": "5.12.14"}, {"status": "affected", "version": "5.12.15"}, {"status": "affected", "version": "5.12.16"}, {"status": "affected", "version": "5.12.17"}, {"status": "affected", "version": "5.12.18"}, {"status": "affected", "version": "5.12.19"}, {"status": "affected", "version": "5.12.20"}, {"status": "affected", "version": "5.12.21"}, {"status": "affected", "version": "5.12.22"}, {"status": "affected", "version": "5.12.23"}, {"status": "affected", "version": "5.12.24"}, {"status": "affected", "version": "5.12.25"}, {"status": "affected", "version": "5.12.26"}, {"status": "affected", "version": "5.12.27"}, {"status": "affected", "version": "5.12.28"}, {"status": "affected", "version": "5.12.29"}, {"status": "affected", "version": "5.12.30"}, {"status": "affected", "version": "5.12.31"}, {"status": "affected", "version": "5.12.32"}, {"status": "affected", "version": "5.12.33"}, {"status": "affected", "version": "5.12.34"}, {"status": "affected", "version": "5.12.35"}, {"status": "affected", "version": "5.12.36"}, {"status": "affected", "version": "5.12.37"}, {"status": "affected", "version": "5.12.38"}]}], "timeline": [{"lang": "en", "time": "2026-01-06T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-01-06T01:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-01-08T10:11:19.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/?id.339720", "name": "VDB-339720 | invoiceninja Migration Import Import.php copy server-side request forgery", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.339720", "name": "VDB-339720 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.721323", "name": "Submit #721323 | invoiceninja <= 5.12.38. ssrf", "tags": ["third-party-advisory"]}, {"url": "https://note-hxlab.wetolink.com/share/fWqEpn5fX4rH", "tags": ["exploit"]}], "descriptions": [{"lang": "en", "value": "A security vulnerability has been detected in invoiceninja up to 5.12.38. The affected element is the function copy of the file /app/Jobs/Util/Import.php of the component Migration Import. The manipulation of the argument company_logo leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "Server-Side Request Forgery"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-02-23T08:22:03.166Z"}}}, "cveMetadata": {"cveId": "CVE-2026-0649", "state": "PUBLISHED", "dateUpdated": "2026-02-23T08:22:03.166Z", "dateReserved": "2026-01-06T16:20:31.689Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-01-07T00:32:07.531Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"modules": ["Migration Import"], "product": "invoiceninja", "vendor": "n/a", "versions": [{"status": "affected", "version": "5.12.0"}, {"status": "affected", "version": "5.12.1"}, {"status": "affected", "version": "5.12.2"}, {"status": "affected", "version": "5.12.3"}, {"status": "affected", "version": "5.12.4"}, {"status": "affected", "version": "5.12.5"}, {"status": "affected", "version": "5.12.6"}, {"status": "affected", "version": "5.12.7"}, {"status": "affected", "version": "5.12.8"}, {"status": "affected", "version": "5.12.9"}, {"status": "affected", "version": "5.12.10"}, {"status": "affected", "version": "5.12.11"}, {"status": "affected", "version": "5.12.12"}, {"status": "affected", "version": "5.12.13"}, {"status": "affected", "version": "5.12.14"}, {"status": "affected", "version": "5.12.15"}, {"status": "affected", "version": "5.12.16"}, {"status": "affected", "version": "5.12.17"}, {"status": "affected", "version": "5.12.18"}, {"status": "affected", "version": "5.12.19"}, {"status": "affected", "version": "5.12.20"}, {"status": "affected", "version": "5.12.21"}, {"status": "affected", "version": "5.12.22"}, {"status": "affected", "version": "5.12.23"}, {"status": "affected", "version": "5.12.24"}, {"status": "affected", "version": "5.12.25"}, {"status": "affected", "version": "5.12.26"}, {"status": "affected", "version": "5.12.27"}, {"status": "affected", "version": "5.12.28"}, {"status": "affected", "version": "5.12.29"}, {"status": "affected", "version": "5.12.30"}, {"status": "affected", "version": "5.12.31"}, {"status": "affected", "version": "5.12.32"}, {"status": "affected", "version": "5.12.33"}, {"status": "affected", "version": "5.12.34"}, {"status": "affected", "version": "5.12.35"}, {"status": "affected", "version": "5.12.36"}, {"status": "affected", "version": "5.12.37"}, {"status": "affected", "version": "5.12.38"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A security vulnerability has been detected in invoiceninja up to 5.12.38. The affected element is the function copy of the file /app/Jobs/Util/Import.php of the component Migration Import. The manipulation of the argument company_logo leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}], "id": "CVE-2026-0649", "lastModified": "2026-06-17T10:11:08.727", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "MULTIPLE", "availabilityImpact": "PARTIAL", "baseScore": 5.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:M/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 6.4, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.0, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-0649", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-07T14:27:52.863067Z", "version": "2.0.3"}}]}, "published": "2026-01-07T12:17:07.547", "references": [{"source": "cna@vuldb.com", "url": "https://note-hxlab.wetolink.com/share/fWqEpn5fX4rH"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?ctiid.339720"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?id.339720"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?submit.721323"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T16:54:45.451487+00:00", "value": {"mitigation_remediation": ["Upgrade InvoiceNinja to the latest release once a patch for the SSRF issue is made available.", "Implement input validation on the company_logo parameter, for example, allow only safe protocols such as https and filter out or block internal IP ranges and file:// schemes.", "Deploy web application firewall rules or reverse\u2011proxy checks that detect and block outbound requests originating from the import endpoint, thereby mitigating potential SSRF traffic until a host\u2011side fix is applied."], "summary": {"action": "Patch ASAP", "impact": "Server\u2011side request forgery allowing a remote attacker to make the InvoiceNinja server request arbitrary URLs, potentially exposing internal resources or exfiltrating data."}, "threat_synthesis": {"affected_systems": "Any instance of InvoiceNinja up to version 5.12.38 is affected, regardless of deployment environment. The flaw exists in the core migration import functionality and is not limited to a specific module or plug\u2011in. Administrators should verify that their deployment is running a version earlier than 5.12.39 and consider upgrading to the most recent release when a fix is available.", "description_and_impact": "The vulnerability resides in the copy method of /app/Jobs/Util/Import.php, part of the Migration Import component. By manipulating the company_logo argument, an attacker can cause the server to perform HTTP requests to arbitrary destinations. This type of server\u2011side request forgery enables a remote actor to reach internal services, discover network topology, or exfiltrate data, thereby compromising confidentiality and availability of internal resources. The weakness is identified as a classic input validation flaw (CWE\u2011918).", "risk_and_exploitability": "The CVSS score is 5.1, indicating moderate risk. EPSS is reported as less than 1\u202f%, implying that the likelihood of exploitation is currently low, though the vulnerability is publicly disclosed and could be abused if the vulnerability remains unpatched. The vulnerability is not listed in CISA\u2019s KEV catalog. The attack can be performed remotely by submitting a crafted company_logo value to the import endpoint, making the server fetch arbitrary URLs. The lack of an official patch or workaround from the vendor demonstrates the criticality of addressing the flaw immediately or mitigating through defensive controls."}}}}, "created": "2026-01-07T10:08:06.839887+00:00", "updated": "2026-04-18T17:00:05.573099+00:00", "vendors": ["invoiceninja", "invoiceninja$PRODUCT$migration_import"]}