An unauthenticated remote code execution and information disclosure vulnerability exists in vas3k TaxHacker that allows attackers to read sensitive local files and probe internal network resources.

This is a Server-Side Request Forgery (CWE-918) vulnerability located in the generateInvoicePDF function within /apps/invoices/actions.ts. The application fails to perform authentication or session validation, allowing an unauthenticated attacker to supply malicious input to the businessLogo parameter, which is then processed by the server as a local file path or an external URL.

The vulnerability poses a severe risk to data confidentiality and internal infrastructure security. An attacker can use the local file read capability to exfiltrate sensitive configuration files or system data, and use the SSRF capability to bypass network perimeters to interact with internal services. Given the CVSS score of 7.3, this represents a high-severity threat that could lead to full system compromise, especially since the official container image typically runs with root privileges.

Immediate Action: As no official patch is currently available, administrators should restrict access to the /apps/invoices/ endpoint at the network or web server level. Disable the affected functionality or implement a strict allow-list for the businessLogo parameter if business requirements permit.

Proactive Monitoring: Review web server and application access logs for anomalous POST requests to the /apps/invoices/actions.ts endpoint, particularly those containing absolute file paths or internal IP addresses in the businessLogo field.

Compensating Controls: Deploy a Web Application Firewall (WAF) to inspect and block incoming requests that attempt to pass non-image URI schemes or local filesystem paths into the application.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the GitHub issue report provided in the research references.

This vulnerability is highly critical due to the combination of unauthenticated access and the ability to read arbitrary files from the host filesystem. Security teams must prioritize isolating the affected TaxHacker instances immediately and should continue to monitor the project repository for an official security patch. Failure to mitigate this risk could result in total exposure of the host environment and internal network assets.