CVE-2026-115729: falha de alta gravidade em pdfme common
@pdfme/common 5.5.10 before 6.2.6 SSRF via isUrlSafeToFetch Bypass
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.9epss 0.4%
@pdfme/common from 5.5.10 before 6.2.6 contains a server-side request forgery vulnerability that allows attackers to bypass the isUrlSafeToFetch denylist in getB64BasePdf. Attackers can supply basePdf URLs using IPv4-mapped IPv6, [::], NAT64 or localhost alias hostnames to read loopback, internal or cloud metadata responses through generated documents.
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
Produtos afetados
pdfme · commonCVEs relacionadas — pdfme common
No mesmo produto, das mais perigosas para as menos.
Referências
https://github.com/pdfme/pdfme/commit/d03d0bc4994ce6921e152879793c5ff52c5600a6https://github.com/pdfme/pdfme/security/advisories/GHSA-2rg9-wxfw-wrr7https://github.com/pdfme/pdfme/security/advisories/GHSA-pgx6-7jcq-2qffhttps://www.vulncheck.com/advisories/pdfme-common-5.5.10-before-6.2.6-ssrf-via-isurlsafetofetch-bypass