{"id":"CVE-2026-114491","aliases":[],"cve":{"records":[{"id":"CVE-2026-114491","source":"VulnCheck","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-21T16:00:25.961Z","published":"2026-10-21T17:54:16.217Z","modified":"2026-10-28T17:31:25.430Z"}],"publishers":[{"name":"VulnCheck","role":"CNA","organizationId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","modified":"2026-10-21T17:54:16.217Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-28T17:31:25.430Z"}],"references":[{"url":"https://github.com/bpampuch/pdfmake/commit/4ad4cbf2713568304dd4cbc3090bfb912a78dfdd","tags":["patch"],"source":"VulnCheck"},{"url":"https://github.com/bpampuch/pdfmake/releases/tag/0.3.12","tags":["release-notes"],"source":"VulnCheck"},{"url":"https://github.com/bpampuch/pdfmake/blob/0.3.11/src/Renderer.js#L350-L372","tags":["technical-description"],"source":"VulnCheck"},{"url":"https://www.vulncheck.com/advisories/pdfmake-0.3.8-before-0.3.12-local-file-policy-bypass-via-svg-images","tags":["third-party-advisory"],"source":"VulnCheck"}],"weaknesses":[{"id":"CWE-73","description":"External Control of File Name or Path","source":"VulnCheck"}],"applicability":[{"source":"VulnCheck","statements":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:pdfmake:pdfmake:*:*:*:*:*:*:*:*","versionStartIncluding":"0.3.8","versionEndExcluding":"0.3.12"}]}]}]}],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-10-28T17:26:52.824167Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"yes"},{"name":"Technical Impact","value":"partial"}]}]},"title":"pdfmake 0.3.8 before 0.3.12 Local File Policy Bypass via SVG Images","titleSource":"VulnCheck","descriptionSource":"VulnCheck","description":"pdfmake 0.3.8 before 0.3.12 fails to apply the setLocalAccessPolicy() restriction to images referenced inside SVG content, allowing attackers to read blocked local files. Attackers supplying a document definition can add an SVG image href pointing to a local path, embedding restricted file contents in the generated PDF.","score":6.9,"severity":"medium","published":"2026-10-21T17:54:16.217Z","modified":"2026-10-28T17:31:25.430Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"bpampuch","name":"pdfmake","platforms":[],"versions":[{"version":"0.3.8","status":"affected","lessThan":"0.3.12","versionType":"semver"}],"defaultStatus":"unaffected","packageURL":"pkg:npm/pdfmake","packageIdentity":{"ecosystem":"npm","name":"pdfmake"},"cpes":[],"source":"VulnCheck","url":"https://www.cve.org/CVERecord?id=CVE-2026-114491"}],"remediation":[],"references":["https://github.com/bpampuch/pdfmake/commit/4ad4cbf2713568304dd4cbc3090bfb912a78dfdd","https://github.com/bpampuch/pdfmake/releases/tag/0.3.12","https://github.com/bpampuch/pdfmake/blob/0.3.11/src/Renderer.js#L350-L372","https://www.vulncheck.com/advisories/pdfmake-0.3.8-before-0.3.12-local-file-policy-bypass-via-svg-images"],"sources":[{"name":"CVE","id":"CVE-2026-114491","modified":"2026-10-28T17:31:25.430Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-114491"}],"assessments":[{"source":"VulnCheck","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","score":6.9},{"source":"VulnCheck","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","score":5.3}],"sourceAffected":[],"observedAt":"2026-10-29T14:34:03.293Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T10:20:31.211Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[],"aiSummary":{"text":"pdfmake versions 0.3.8 before 0.3.12 have a local file policy bypass weakness via SVG images, allowing attackers with document definition supply access to read blocked local files. The weakness is due to the failure to apply the setLocalAccessPolicy() restriction to images referenced inside SVG content. This may embed restricted file contents in the generated PDF.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T08:46:31.993Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-114491"}]}}