CVE-2026-115729

MediumCVSS 6.8

Published: 23/10/2026(UTC)Updated: 29/10/2026(UTC)Translated: 23/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.44%

38th percentile - higher than 38% of all known CVEs

Summary

@pdfme/common from 5.5.10 before 6.2.6 contains an SSRF vulnerability that bypasses the isUrlSafeToFetch denylist in getB64BasePdf. Attackers can supply basePdf URLs using IPv4-mapped IPv6, [::], NAT64 or localhost alias hostnames to read loopback, internal or cloud metadata responses through generated documents.

Risk Assessment

An attacker can read data from internal services or cloud metadata, potentially leading to leakage of sensitive information.

Recommendation

Upgrade @pdfme/common to version 6.2.6 or later. Add extra validation of basePdf URLs covering IPv6 representations and localhost aliases.

Other vulnerabilities in @pdfme/common

CVE-2026-82866Medium
@pdfme/common before 5.5.10 contains a server-side request forgery vulnerability in the getB64BasePdf function that fetches arbitrary URLs without validation when basePdf is attacker-controlled. Attackers who control the basePdf template field can force servers or clients to make requests to internal endpoints, enabling metadata exfiltration, network reconnaissance, and blind request forgery attacks.

Original NVD description (English source)

@pdfme/common from 5.5.10 before 6.2.6 contains a server-side request forgery vulnerability that allows attackers to bypass the isUrlSafeToFetch denylist in getB64BasePdf. Attackers can supply basePdf URLs using IPv4-mapped IPv6, [::], NAT64 or localhost alias hostnames to read loopback, internal or cloud metadata responses through generated documents.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS