CVE-2026-82866
MediumCVSS 6.8Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
@pdfme/common before 5.5.10 contains a server-side request forgery vulnerability in the getB64BasePdf function that fetches arbitrary URLs without validation when basePdf is attacker-controlled. Attackers who control the basePdf template field can force servers or clients to make requests to internal endpoints, enabling metadata exfiltration, network reconnaissance, and blind request forgery attacks.
Risk Assessment
The SSRF risk may lead to access to internal network resources, potentially resulting in data leakage or further attacks on infrastructure.
Recommendation
It is recommended to upgrade @pdfme/common to version 5.5.10 or later, which includes a fix for this vulnerability.
Other vulnerabilities in @pdfme/common
Original NVD description (English source)
@pdfme/common before 5.5.10 contains a server-side request forgery vulnerability in the getB64BasePdf function that fetches arbitrary URLs without validation when basePdf is attacker-controlled. Attackers who control the basePdf template field can force servers or clients to make requests to internal endpoints, enabling metadata exfiltration, network reconnaissance, and blind request forgery attacks.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS