CVE-2025-0474

High

Description

Invoice Ninja is vulnerable to authenticated Server-Side Request Forgery (SSRF) allowing for arbitrary file read and network resource requests as the application user. This issue affects Invoice Ninja: from 5.8.56 through 5.11.23.

SeverityHigh

CVSS7.7

Exploit probability—

ProductInvoice Ninja

PublishedJan 14, 2025

First seenJan 14, 2025

Weakness typeCWE-918Server-side request forgery (SSRF)

How to fix

Patches

github.com/invoiceninja/invoiceninja/commit/2a9bf353b432d7060e85487b617151ecbc36247d
github.com/invoiceninja/invoiceninja/compare/97ae948618230c1812f3223b80bf22dcb0382dc5..435780932fe19063001d79ba518815df62773d71

Affected products

Product	Affected versions	Fixed in
Invoice Ninja Invoice Ninja	5.8.56 ≤ v ≤ 5.11.23	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.