CVE-2026-0649 | invoiceninja up to 5.12.38 Migration Import Import.php copy company_logo server-side request forgery

A vulnerability identified as critical has been detected in invoiceninja up to 5.12.38. The affected element is the function copy of the file /app/Jobs/Util/Import.php of the component Migration Import. The manipulation of the argument company_logo leads to server-side request forgery.

This vulnerability is traded as CVE-2026-0649. It is possible to initiate the attack remotely. Furthermore, there is an exploit available.

The vendor was contacted early about this disclosure but did not respond in any way.