Platform
php
Component
invoiceninja
Fixed in
5.11.24
CVE-2025-0474 describes an authenticated Server-Side Request Forgery (SSRF) vulnerability affecting Invoice Ninja. This vulnerability allows attackers to trigger arbitrary file read operations and network resource requests as the application user, potentially leading to sensitive data exposure or unauthorized access. The vulnerability impacts Invoice Ninja versions 5.8.56 through 5.11.23, and a patch is available in version 5.11.24.
The SSRF vulnerability in Invoice Ninja allows an authenticated attacker to craft requests that the application will execute on behalf of the user. This can be exploited to read local files on the server, potentially exposing configuration files, database credentials, or other sensitive data. Furthermore, the attacker can leverage the SSRF to interact with internal network resources that are not directly accessible from the outside, enabling lateral movement or access to other systems within the network. The potential impact extends to data breaches, system compromise, and disruption of business operations.
CVE-2025-0474 was publicly disclosed on 2025-01-14. There are currently no known public proof-of-concept exploits available. The EPSS score is pending evaluation. Monitor security advisories and threat intelligence feeds for any indications of active exploitation.
Exploit Status
EPSS
0.17% (38% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2025-0474 is to upgrade Invoice Ninja to version 5.11.24 or later, which contains the fix. If immediate upgrading is not possible, consider implementing temporary workarounds such as restricting outbound network access from the Invoice Ninja application server using a Web Application Firewall (WAF) or proxy. Configure the WAF to block requests to potentially sensitive internal resources. Carefully review and restrict any user-controlled input that is used to construct URLs within the application. After upgrading, confirm the fix by attempting to trigger an SSRF request and verifying that it is blocked.
Update Invoice Ninja to a version later than 5.11.23. This will resolve the SSRF vulnerability that allows for arbitrary file read and network resource requests as the application user. See the release notes for more details about the update.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2025-0474 is a Server-Side Request Forgery vulnerability in Invoice Ninja versions 5.8.56–5.11.23, allowing attackers to trigger arbitrary file reads and network requests.
You are affected if you are running Invoice Ninja versions 5.8.56 through 5.11.23. Upgrade to 5.11.24 or later to mitigate the risk.
Upgrade Invoice Ninja to version 5.11.24 or later. As a temporary workaround, restrict outbound network access using a WAF or proxy.
There are currently no known public exploits or confirmed active exploitation campaigns for CVE-2025-0474.
Refer to the Invoice Ninja security advisory on their official website or blog for detailed information and updates.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.