CVE-2026-55386

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-55386

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55386.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-55386

Aliases

GHSA-cp8p-jcqf-j39c

Published

2026-10-14T19:18:57Z

Modified

2026-10-15T10:47:32Z

Severity

7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

InvoiceShelf ORDER BY SQL injection through orderByField

Details

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf passes the authenticated user's orderByField query parameter into Laravel orderBy calls in Invoice::scopeApplyFilters without restricting the value to column identifiers. A crafted SQL expression can therefore enter the ORDER BY clause across invoice and other list endpoints, enabling boolean-based blind extraction of database information. This issue is fixed in version 2.4.0.

Database specific

{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-89"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55386.json"
}

References

Affected packages

Git / github.com/invoiceshelf/invoiceshelf

Affected ranges

Type

GIT

Repo

https://github.com/invoiceshelf/invoiceshelf

Events

Introduced

Fixed

e3ab12ad773749668dc64e029d265a8440e21477

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "2.4.0"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

1.*

1.0.0

1.1.0

1.2.0

1.2.1

1.2.2

1.3.0

2.*

2.0.0

2.0.0-RC1

2.1.0

2.1.0-RC1

2.1.1

2.2.0

2.2.1

2.3.0

2.3.1

2.3.2

2.3.3

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55386.json"