CVE-2026-114491
CVE-2026-114491 · pdfmake 0.3.8 before 0.3.12 Local File Policy Bypass via SVG Images
This page contains facts from public vulnerability sources. Check the original advisory before updating.
pdfmake 0.3.8 before 0.3.12 fails to apply the setLocalAccessPolicy() restriction to images referenced inside SVG content, allowing attackers to read blocked local files. Attackers supplying a document definition can add an SVG image href pointing to a local path, embedding restricted file contents in the generated PDF.
CVSS 6.9 · Medium · EPSS 0.3% · Fix available
- Published
- Updated
Affected products and versions
pdfmake
- Versions
- ≥ 0.3.8, < 0.3.12: Affected (semver)
Update to 0.3.12
Original sources
- https://github.com/bpampuch/pdfmake/commit/4ad4cbf2713568304dd4cbc3090bfb912a78dfdd
- https://github.com/bpampuch/pdfmake/releases/tag/0.3.12
- https://github.com/bpampuch/pdfmake/blob/0.3.11/src/Renderer.js#L350-L372
- https://www.vulncheck.com/advisories/pdfmake-0.3.8-before-0.3.12-local-file-policy-bypass-via-svg-images
- https://nvd.nist.gov/vuln/detail/CVE-2026-114491