CVE-2025-0474

Invoice Ninja PDF Rendering Server Side Request Forgery

7.7 High

Invoice Ninja is vulnerable to authenticated Server-Side Request Forgery (SSRF) allowing for arbitrary file read and network resource requests as the application user. This issue affects Invoice Ninja: from 5.8.56 through 5.11.23.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

0.41%Up 0.3 points since Jan 15, 2025

What each source reports

CVE List Score used 7.7

Invoice Ninja PDF Rendering Server Side Request Forgery

Record: CVE-2025-0474
CVSS 3.1: 7.7 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Weakness: CWE-918
Updated: 2026-11-02

EUVDEUVD-2025-1699 7.7

Record: EUVD-2025-1699
CVSS 3.1: 7.7 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-j2m4-4rvg-26j8 7.7

Invoice Ninja is vulnerable to authenticated Server-Side Request Forgery (SSRF) allowing for...

Record: GHSA-j2m4-4rvg-26j8
CVSS 3.1: 7.7 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Weakness: CWE-918
Updated: 2026-11-02

NVD 7.7

Record: CVE-2025-0474
CVSS 3.1: 7.7 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Weakness: CWE-918
Updated: 2026-11-02

OSV 7.7

Invoice Ninja PDF Rendering Server Side Request Forgery

Record: CVE-2025-0474
CVSS 3.1: 7.7 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Weakness: CWE-918
Updated: 2026-11-02

Affected products

invoice ninja ninja

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-0474 is a high vulnerability (CVSS 7.7) in Invoice Ninja Ninja, published January 14, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.41%, the 35th percentile. No source names a fixed version.