Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-114609— fpdf2 implicitly loads external URLs and local image paths when rendering attacker-controlled content

Quick assessment

Affected
py-pdf fpdf2
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

fpdf2 是一个用于 Python 的 PDF 生成库。在 2.8.8 版本之前，fpdf2 的共享图像加载器会自动解引用由攻击者控制的 HTTP(S) URL 以及通过 、 中的 HTML 属性、SVG 中的 或 属性、以及模板图像字段传入的原始本地路径。这可能导致向攻击者选定的内部或外部服务发起出站请求，并尝试打开本地文件；不过，本地内容仅在其为有效的受支持图像或 SVG 资源时才会被暴露。 协议 URL 未被特殊处理，因此本地路径情形需要提供原始文件系统路径。该问题已在 2.8.8 版本中修复。

CVSS 5.8 · Medium

Affected Version Matrix 1

VendorProduct Version RangeStatus
py-pdf fpdf2 < 2.8.8 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-114609

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
fpdf2 implicitly loads external URLs and local image paths when rendering attacker-controlled content
Source: CVE Program / CVE List V5
Vulnerability Description
fpdf2 is a PDF creation library for Python. Prior to 2.8.8, fpdf2's shared image loader automatically dereferences attacker-controlled HTTP(S) URLs and raw local paths supplied through FPDF.image(), FPDF.write_html() HTML <img src> values, SVG <image href> or xlink:href values, and template image fields. This can cause outbound requests to attacker-selected internal or external services and local file open attempts, although local content is exposed only when it is a valid supported image or SVG resource. file:// URLs are not specially handled, so the local-path case requires a raw filesystem path. This issue is fixed in version 2.8.8.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
py-pdf fpdf2 < 2.8.8 -

II. Public POCs for CVE-2026-114609

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-114609

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-114609 (3)

Vendor Advisories for CVE-2026-114609 (1)

Vendor Pages for CVE-2026-114609 (1)

IV. Related Vulnerabilities

Same product: fpdf2
Same vendor: py-pdf
Same weakness: CWE-918

V. Comments for CVE-2026-114609

No comments yet

Leave a comment