CVE-2026-114609

Name of the Vulnerable Software and Affected Versions fpdf2 versions prior to 2.8.8

Description The shared image loader in this PDF creation library automatically dereferences attacker-controlled HTTP(S) URLs and raw local paths. This occurs when input is supplied through the FPDF.image() function, FPDF.write html() HTML <img src> values, SVG <image href> or xlink:href values, and template image fields. This behavior can lead to outbound requests to internal or external services and attempts to open local files, though local content is only exposed if it is a supported image or SVG resource. Since file:// URLs are not specially handled, local path exploitation requires a raw filesystem path.

Recommendations Update to version 2.8.8.