Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N L N L N L N N 2.1 .0035 26.2 —
AFFECTED Product Versions Fixed Invoice Ninja 5.13.0 – —
TIMELINE Aug 31 Reserved by VulDB Sep 1 Published (CNA: VulDB) Sep 2 EXPLOIT PUBLISHED — CVE-2026-83744 (invoiceninja Invoice Ninja). Public exploit reference added.
A security vulnerability has been detected in invoiceninja Invoice Ninja up to 5.13.26. This vulnerability affects the function Purify::isHostSafe of the file app/Services/Pdf/Purify.php of the component invoices Endpoint. The manipulation of the argument notes leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
| Date | Event | Detail |
|---|---|---|
| August 31, 2026 | Reserved | Reserved by VulDB |
| September 1, 2026 | Published | Published (CNA: VulDB) |
| September 2, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-83744 (invoiceninja Invoice Ninja). Public exploit reference added. |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| invoiceninja | Invoice Ninja | — | 5.13.0 | — |
Authoritative record: CVE-2026-83744 at cve.org
Vendors: invoiceninja
Weaknesses: CWE-918
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-83744 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
