{"id":"CVE-2026-114609","aliases":["GHSA-rw7v-4hrq-x6r9"],"title":"fpdf2 implicitly loads external URLs and local image paths when rendering attacker-controlled content","summary":"fpdf2 implicitly loads external URLs and local image paths when rendering attacker-controlled content","severity":"medium","cvss":5.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","vendor":"fpdf2","product":"fpdf2","ecosystem":"pip","affected":["fpdf2 < 2.8.8"],"patched":["fpdf2 2.8.8"],"published":"2026-10-27","updated":"2026-10-27","sourceUpdated":"2026-10-27T15:00:04.995148902Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-rw7v-4hrq-x6r9","references":[{"url":"https://github.com/py-pdf/fpdf2/security/advisories/GHSA-rw7v-4hrq-x6r9"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114609"},{"url":"https://github.com/py-pdf/fpdf2/pull/1824"},{"url":"https://github.com/py-pdf/fpdf2/pull/1857"},{"url":"https://github.com/py-pdf/fpdf2/commit/0d27190a8c907e02ebe9cd881471a14d0622b432"},{"url":"https://github.com/py-pdf/fpdf2/commit/6e23f610b7946e96e9a5dd0535dcbfbe7ac1397d"},{"url":"https://github.com/py-pdf/fpdf2"},{"url":"https://github.com/py-pdf/fpdf2/releases/tag/2.8.8"},{"url":"https://github.com/advisories/GHSA-rw7v-4hrq-x6r9"}],"tags":["osv","pip","ghsa","cve.org"],"epss":0.00252,"epssPercentile":0.16585,"cwe":["CWE-918"],"ingestedAt":"2026-10-22T22:00:50.349Z","slug":"CVE-2026-114609","body":"## Overview\n\n## Summary\n\n`fpdf2` implicitly dereferences image resource references supplied to rendering APIs. If an application passes untrusted HTML, SVG, template data, or image paths into those APIs, `fpdf2` may issue outbound HTTP(S) requests or attempt to open local filesystem paths.\n\nThis behavior is relevant in applications that render untrusted or user-provided input without sanitizing or restricting embedded resource references.\n\n## Description\n\nIn affected versions, `fpdf2` uses a shared internal image-loading mechanism for multiple features. This loader:\n\n* fetches `http://` and `https://` URLs over the network\n* opens other string values as local filesystem paths\n\nDuring document processing, resource references embedded in input content are automatically dereferenced using this mechanism.\n\nThis behavior is reachable through:\n\n* `FPDF.image()`\n* `FPDF.write_html()` via HTML `<img src=\"...\">`\n* `FPDF.image()` when rendering SVG files containing `<image href=\"...\">` or `xlink:href=\"...\">`\n* template image elements that forward values into `FPDF.image()`\n\nIf an application renders attacker-controlled input through these APIs, that input can cause:\n\n* outbound HTTP(S) requests to attacker-chosen destinations\n* local file open attempts for attacker-chosen paths\n\nThis may enable Server-Side Request Forgery (SSRF) in applications that render untrusted content.\n\nLocal file access impact is limited: the library attempts to open the referenced path, but successful embedding depends on the target being a valid and supported image or SVG resource.\n\n`file://` URLs are not specially handled; raw filesystem paths such as `/path/to/file` or `../../file.png` are the relevant local-path cases.\n\n## Impact\n\nThis issue affects applications that render untrusted or partially trusted content using `fpdf2`.\n\nApplications may be impacted if they:\n\n* pass untrusted HTML into `write_html()`\n* render untrusted SVG with embedded `<image>` references\n* pass user-controlled strings into `image()`\n* allow untrusted template definitions or template field values to control image paths\n\nPotential impacts include:\n\n* outbound requests to internal or external network services\n* limited local file access attempts depending on file type and parsing success (limited to content that fpdf2 recognizes as a supported image or SVG resource)\n\nThe severity depends on how `fpdf2` is integrated and whether untrusted input is allowed to control resource references.\n\n**Example scenarios**\n\nHTML:\n```python\npdf.write_html('<img src=\"http://127.0.0.1:8000/internal.png\">')\n```\n\nSVG:\n```xml\n<image href=\"http://169.254.169.254/latest/meta-data/\" />\n```\n\nDirect image path:\n```python\npdf.image(\"../../.env\")\n```\n\n**Workarounds**\n\nApplications can mitigate this by:\n\n- not rendering untrusted HTML, SVG, or template content\n- rejecting user-controlled `src` / `href` / image-path values\n- mapping resources through an application-defined allowlist\n- converting user-supplied images to trusted in-memory objects before passing them to `fpdf2`\n\n**Credits**\n\n- @kule500 for identifying SSRF via HTML <img> handling\n- @BudongJW for identifying SVG <image> resource loading as an additional vector\n- @redyank for analysis of the shared image loading mechanism\n- @manop55555 for identifying a DNS rebinding bypass in the initial REMOTE_PUBLIC implementation\n\n## Affected packages\n\n- `fpdf2 < 2.8.8`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `fpdf2 2.8.8`","depth":"sunlit","depthScore":32,"depthScoreParts":{"impact":31.9,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}