CVE-2026-114491
CVE-2026-114491 · pdfmake 0.3.8 before 0.3.12 Local File Policy Bypass via SVG Images
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
pdfmake 0.3.8 before 0.3.12 fails to apply the setLocalAccessPolicy() restriction to images referenced inside SVG content, allowing attackers to read blocked local files. Attackers supplying a document definition can add an SVG image href pointing to a local path, embedding restricted file contents in the generated PDF.
CVSS 6.9 · Media · EPSS 0,3% · Corrección disponible
- Publicación
- Actualización
Productos y versiones afectados
pdfmake
- Versiones
- ≥ 0.3.8, < 0.3.12: Afectada (semver)
Actualiza a 0.3.12
Fuentes originales
- https://github.com/bpampuch/pdfmake/commit/4ad4cbf2713568304dd4cbc3090bfb912a78dfdd
- https://github.com/bpampuch/pdfmake/releases/tag/0.3.12
- https://github.com/bpampuch/pdfmake/blob/0.3.11/src/Renderer.js#L350-L372
- https://www.vulncheck.com/advisories/pdfmake-0.3.8-before-0.3.12-local-file-policy-bypass-via-svg-images
- https://nvd.nist.gov/vuln/detail/CVE-2026-114491