CVE-2026-108554

Name of the Vulnerable Software and Affected Versions PDFMathTranslate (pdf2zh) versions prior to 1.9.12

Description An unauthenticated attacker can perform a server-side request forgery (SSRF), which occurs when a server is tricked into making requests to an unintended location. The issue exists because the translate file handler passes user-supplied URLs to the download with limit() function without validating the scheme or address. This allows attackers to use the Link input to force the server to fetch arbitrary URLs, potentially accessing internal services and cloud metadata endpoints to retrieve returned PDFs.

Recommendations Update PDFMathTranslate (pdf2zh) to version 1.9.12 or later. As a temporary mitigation, restrict access to the Link input field to prevent unauthorized URL requests.