The software uses a vulnerable pdfkit library for PDF generation, which allows authenticated attackers to perform server-side request forgery (SSRF) and local file inclusion (LFI). By providing specially crafted content to the PDF rendering process, an attacker can force the server to retrieve internal resources or embed local server files within the resulting PDF documents.