CVE-2026-29925

HighPublic PoC

Published: 30 March 2026

Published

30 March 2026

Modified

02 April 2026

KEV Added

—

Patch

—

CVSS Score 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

EPSS Score 0.0004 10.8th percentile

Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-29925 is a high-severity SSRF (CWE-918) vulnerability in Invoiceninja Invoice Ninja. Its CVSS base score is 7.7 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 10.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match

prevent

Directly mitigates SSRF by validating user-supplied inputs in CheckDatabaseRequest.php to prevent unauthorized server-initiated requests.

SI-2 Flaw Remediation good match

prevent

Remediates the specific SSRF flaw in Invoice Ninja v5.12.46 and v5.12.48 through timely patching or upgrades.

SC-7 Boundary Protection partial match

prevent

Enforces boundary protections like firewalls or proxies to restrict outbound requests from the vulnerable application to unauthorized internal resources.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1046 Network Service Discovery Discovery

Adversaries may attempt to get a listing of services running on remote hosts and local network infrastructure devices, including those that may be vulnerable to remote software exploitation.

attack.mitre.org →

Why these techniques?

SSRF in public-facing web app (Invoice Ninja) is directly exploited via T1190; the ability to force arbitrary outbound requests from the server enables internal network/port probing consistent with T1046.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Invoice Ninja v5.12.46 and v5.12.48 is vulnerable to Server-Side Request Forgery (SSRF) in CheckDatabaseRequest.php.

Deeper analysisAI

CVE-2026-29925 is a Server-Side Request Forgery (SSRF) vulnerability, mapped to CWE-918, affecting Invoice Ninja versions v5.12.46 and v5.12.48 in the CheckDatabaseRequest.php component. Published on 2026-03-30, it carries a CVSS v3.1 base score of 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N), highlighting its network-accessible nature, low attack complexity, requirement for low privileges, lack of user interaction, changed scope, and high confidentiality impact with no integrity or availability effects.

A low-privileged authenticated user can exploit this SSRF over the network with low complexity and no user interaction. Exploitation enables the attacker to manipulate the server into initiating unauthorized requests, potentially resulting in high confidentiality impacts such as disclosure of sensitive internal data or access to resources behind firewalls.

Key references include a GitHub gist at https://gist.github.com/TrekLaps/5b2c72106d950dab0cd1897eb93200f1 and the vulnerable source code at https://github.com/invoiceninja/invoiceninja/blob/v5-stable/app/Http/Requests/Setup/CheckDatabaseRequest.php, which security practitioners should review for details on the issue and potential mitigations like input validation or upgrades beyond the affected versions.