CVE-2021-33898

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-06-06 · updated 2026-06-17
Weakness: CWE-502

Description

In Invoice Ninja before 4.4.0, there is an unsafe call to unserialize() in app/Ninja/Repositories/AccountRepository.php that may allow an attacker to deserialize arbitrary PHP classes. In certain contexts, this can result in remote code execution. The attacker's input must be hosted at http://www.geoplugin.net (cleartext HTTP), and thus a successful attack requires spoofing that site or obtaining control of it.

Affected products

invoiceninja: before 4.4.0 — fixed in 4.4.0

How to fix

Upgrade to a fixed version: invoiceninja 4.4.0. Check the vendor advisory for mitigations.

References

https://github.com/invoiceninja/invoiceninja/issues/5909
https://github.com/invoiceninja/invoiceninja/issues/5909

Get alerted when CVE-2021-33898 or the next vulnerability affects your stack