{"id":"GHSA-rw7v-4hrq-x6r9","aliases":["CVE-2026-114609"],"title":"fpdf2 implicitly loads external URLs and local image paths when rendering attacker-controlled content","description":"## Summary\n\n`fpdf2` implicitly dereferences image resource references supplied to rendering APIs. If an application passes untrusted HTML, SVG, template data, or image paths into those APIs, `fpdf2` may issue outbound HTTP(S) requests or attempt to open local filesystem paths.\n\nThis behavior is relevant in applications that render untrusted or user-provided input without sanitizing or restricting embedded resource references.\n\n## Description\n\nIn affected versions, `fpdf2` uses a shared internal image-loading mechanism for multiple features. This loader:\n\n* fetches `http://` and `https://` URLs over the network\n* opens other string values as local filesystem paths\n\nDuring document processing, resource references embedded in input content are automatically dereferenced using this mechanism.\n\nThis behavior is reachable through:\n\n* `FPDF.image()`\n* `FPDF.write_html()` via HTML `<img src=\"...\">`\n* `FPDF.image()` when rendering SVG files containing `<image href=\"...\">` or `xlink:href=\"...\">`\n* template image elements that forward values into `FPDF.image()`\n\nIf an application renders attacker-controlled input through these APIs, that input can cause:\n\n* outbound HTTP(S) requests to attacker-chosen destinations\n* local file open attempts for attacker-chosen paths\n\nThis may enable Server-Side Request Forgery (SSRF) in applications that render untrusted content.\n\nLocal file access impact is limited: the library attempts to open the referenced path, but successful embedding depends on the target being a valid and supported image or SVG resource.\n\n`file://` URLs are not specially handled; raw filesystem paths such as `/path/to/file` or `../../file.png` are the relevant local-path cases.\n\n## Impact\n\nThis issue affects applications that render untrusted or partially trusted content using `fpdf2`.\n\nApplications may be impacted if they:\n\n* pass untrusted HTML into `write_html()`\n* render untrusted SVG with embedded `<image>` references\n* pass user-controlled strings into `image()`\n* allow untrusted template definitions or template field values to control image paths\n\nPotential impacts include:\n\n* outbound requests to internal or external network services\n* limited local file access attempts depending on file type and parsing success (limited to content that fpdf2 recognizes as a supported image or SVG resource)\n\nThe severity depends on how `fpdf2` is integrated and whether untrusted input is allowed to control resource references.\n\n**Example scenarios**\n\nHTML:\n```python\npdf.write_html('<img src=\"http://127.0.0.1:8000/internal.png\">')\n```\n\nSVG:\n```xml\n<image href=\"http://169.254.169.254/latest/meta-data/\" />\n```\n\nDirect image path:\n```python\npdf.image(\"../../.env\")\n```\n\n**Workarounds**\n\nApplications can mitigate this by:\n\n- not rendering untrusted HTML, SVG, or template content\n- rejecting user-controlled `src` / `href` / image-path values\n- mapping resources through an application-defined allowlist\n- converting user-supplied images to trusted in-memory objects before passing them to `fpdf2`\n\n**Credits**\n\n- @kule500 for identifying SSRF via HTML <img> handling\n- @BudongJW for identifying SVG <image> resource loading as an additional vector\n- @redyank for analysis of the shared image loading mechanism\n- @manop55555 for identifying a DNS rebinding bypass in the initial REMOTE_PUBLIC implementation","severity":"medium","score":5.8,"published":"2026-10-27T14:43:16.000Z","modified":"2026-10-27T15:00:04.995Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"PyPI","name":"fpdf2","ranges":[{"events":[{"introduced":"0"},{"fixed":"2.8.8"}],"type":"ECOSYSTEM"}],"versions":["2.0.0","2.0.1","2.0.3","2.0.4","2.0.5","2.0.6","2.1.0","2.1.0rc1","2.2.0","2.2.0rc1","2.2.0rc2","2.2.0rc3","2.3.0","2.3.1","2.3.2","2.3.3","2.3.4","2.3.5","2.4.0","2.4.1","2.4.2","2.4.3","2.4.4","2.4.5","2.4.6","2.5.0","2.5.1","2.5.2","2.5.3","2.5.4","2.5.5","2.5.6","2.5.7","2.6.0","2.6.1","2.7.0","2.7.1","2.7.2","2.7.3","2.7.4","2.7.5","2.7.6","2.7.7","2.7.8","2.7.9","2.8.1","2.8.2","2.8.3","2.8.4","2.8.5","2.8.6","2.8.7"],"fixed":["2.8.8"]}],"references":["https://github.com/py-pdf/fpdf2/security/advisories/GHSA-rw7v-4hrq-x6r9","https://nvd.nist.gov/vuln/detail/CVE-2026-114609","https://github.com/py-pdf/fpdf2/pull/1824","https://github.com/py-pdf/fpdf2/pull/1857","https://github.com/py-pdf/fpdf2/commit/0d27190a8c907e02ebe9cd881471a14d0622b432","https://github.com/py-pdf/fpdf2/commit/6e23f610b7946e96e9a5dd0535dcbfbe7ac1397d","https://github.com/py-pdf/fpdf2","https://github.com/py-pdf/fpdf2/releases/tag/2.8.8"],"sources":[{"name":"OSV","id":"GHSA-rw7v-4hrq-x6r9","modified":"2026-10-27T15:00:04.995148902Z","url":"https://osv.dev/vulnerability/GHSA-rw7v-4hrq-x6r9"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","score":5.8}]}