Live › vulnerability › CVE-2026-114609
Go to dashboardfpdf2, a Python PDF library, automatically fetches HTTP(S) URLs and opens raw local paths passed as image sources, including in HTML img tags and SVG image references. An attacker who controls those inputs can make the server send requests to internal or external services and read local files that happen to be valid images or SVGs.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications that generate PDFs from user-supplied content, such as HTML with img tags, SVG, or templates with image fields, using a version before 2.8.8. Apps that only embed images from fixed, trusted paths have little exposure. unknown for any other deployment detail.
No product ranges from the sources yet.
pip show fpdf2 and check whether the version is below 2.8.8FPDF.image(, write_html( and template image fields that take user-supplied sources2.8.8 or later with pip install --upgrade fpdf2Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
fpdf2 is a PDF creation library for Python. Prior to 2.8.8, fpdf2's shared image loader automatically dereferences attacker-controlled HTTP(S) URLs and raw local paths supplied through FPDF.image(), FPDF.write_html() HTML <img src> values, SVG <image href> or xlink:href values, and template image fields. This can cause outbound requests to attacker-selected internal or external services and local file open attempts, although local content is exposed only when it is a valid supported image or SVG resource. file:// URLs are not specially handled, so the local-path case requires a raw filesystem path. This issue is fixed in version 2.8.8.
This page as .md · .json · in your agent: get_signal("CVE-2026-114609")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.