CVE-2026-114609: fpdf2 implicitly loads external URLs and local image paths when rendering attacker-controlled content
fpdf2 implicitly dereferences image resource references supplied to rendering APIs. If an application passes untrusted HTML, SVG, template data, or image paths into those APIs, fpdf2 may issue outbound HTTP(S) requests or attempt to open local filesystem paths.
This behavior is relevant in applications that render untrusted or user-provided input without sanitizing or restricting embedded resource references.
References
- github.com/advisories/GHSA-rw7v-4hrq-x6r9
- github.com/py-pdf/fpdf2/commit/0d27190a8c907e02ebe9cd881471a14d0622b432
- github.com/py-pdf/fpdf2/commit/6e23f610b7946e96e9a5dd0535dcbfbe7ac1397d
- github.com/py-pdf/fpdf2/pull/1824
- github.com/py-pdf/fpdf2/pull/1857
- github.com/py-pdf/fpdf2/releases/tag/2.8.8
- github.com/py-pdf/fpdf2/security/advisories/GHSA-rw7v-4hrq-x6r9
- nvd.nist.gov/vuln/detail/CVE-2026-114609
Code Behaviors & Features
Detect and mitigate CVE-2026-114609 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →