fpdf2 Flaws Allow Remote File Fetching and Denial of Service

Threat: Vulnerability

Targeted Region: Global

Targeted Sector: Technology & IT

Criticality: Medium

[subscribe_to_unlock_form]

EXECUTIVE SUMMARY:

Multiple vulnerabilities have been identified in fpdf2, a PDF generation library. The flaws can allow network requests triggered by untrusted content and denial of service through crafted SVG input. Applications that process untrusted HTML, SVG, or template data may be exposed to server-side request forgery and excessive CPU or memory consumption.

CVE-2026-114609 (CVSS 5.8 — Medium): The image-loading mechanism in fpdf2 can dereference resource references from untrusted HTML, SVG, or template data, causing outbound HTTP or HTTPS requests or local file open attempts. A remote attacker who controls rendered content can trigger server-side request forgery and limited local file access when the application passes that content to the affected rendering APIs.[/subscribe_to_unlock_form]

EXECUTIVE SUMMARY:

CVE-2026-114610 (CVSS 6.5 — Medium): The SVG reference handling in fpdf2 deep-copies referenced graphics objects, allowing nested use references to expand exponentially during image processing. A remote attacker with low privileges can submit a small crafted SVG to an application that passes it to the image rendering function, causing CPU and memory exhaustion and denial of service.