CVE-2026-34586
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
PdfDing prior to version 1.7.1 does not check in check_shared_access_allowed() whether a shared PDF is inactive (expired, reached view limit) or deleted. Previously authorized users can still access the PDF after expiration or deletion.
Risk Assessment
Confidential documents may remain accessible to unauthorized users even after sharing expires, violating access policies.
Recommendation
Upgrade PdfDing to version 1.7.1 or later.
Original NVD description (English source)
PdfDing is a selfhosted PDF manager, viewer and editor offering a seamless user experience on multiple devices. Prior to version 1.7.1, check_shared_access_allowed() validates only session existence — it does not check SharedPdf.inactive (expiration / max views) or SharedPdf.deleted. The Serve and Download endpoints rely solely on this function, allowing previously-authorized users to access shared PDF content after expiration, view limit, or soft-deletion. This issue has been patched in version 1.7.1.