CVE-2025-56589

HighCVSS 7.5

Published: 22/01/2026(UTC)Updated: 05/07/2026(UTC)Translated: 06/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.40%

32th percentile - higher than 32% of all known CVEs

Summary

Local File Inclusion (LFI) and Server-Side Request Forgery (SSRF) vulnerabilities were found in the InsertFromHtmlString() function of the Apryse HTML2PDF SDK up to version 11.6.0. These allow an attacker to read local files on the server and make arbitrary HTTP requests to internal or external services.

Risk Assessment

The risk includes disclosure of sensitive data (e.g., configuration files, passwords) and potential system takeover by exploiting SSRF to attack internal resources.

Recommendation

Immediately update Apryse HTML2PDF SDK to a version newer than 11.6.0 if available, or apply temporary mitigations such as input validation and restricting access to the InsertFromHtmlString() function.

Other vulnerabilities in Apryse HTML2PDF SDK

CVE-2025-56590Critical
An issue was discovered in the InsertFromURL() function of the Apryse HTML2PDF SDK through version 11.10, which could allow an attacker to execute arbitrary operating system commands on the local server.

Original NVD description (English source)

A Local File Inclusion (LFI) and a Server-Side Request Forgery (SSRF) vulnerability was found in the InsertFromHtmlString() function of the Apryse HTML2PDF SDK thru 11.6.0. These vulnerabilities could allow an attacker to read local files on the server or make arbitrary HTTP requests to internal or external services. Both vulnerabilities could lead to the disclosure of sensitive data or potential system takeover.