PT-2026-120741

CVE-2026-114491

·

Published

2026-10-21

·

Updated

2026-10-21

Description by

CVSS 3.1
5.3
Medium
MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
pdfmake 0.3.8 before 0.3.12 fails to apply the setLocalAccessPolicy() restriction to images referenced inside SVG content, allowing attackers to read blocked local files. Attackers supplying a document definition can add an SVG image href pointing to a local path, embedding restricted file contents in the generated PDF.
Exploitability
Fix
Researchers
Vendors
Affected products
Weakness enumeration
CWE-73: External Control of File Name or Path
Related identifiers
CVE-2026-114491
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com