CVE-2024-1647CWE-79

pyhtml2pdf 0.0.6 - Local File Read via Server Side XSS

High · published February 19, 2024

CVSS v3.1
7.5
EPSS
1%
Percentile
52.4
In the wild
Unconfirmed
What it is

Pyhtml2pdf version 0.0.6 allows an external attacker to remotely obtain

arbitrary local files. This is possible because the application does not

validate the HTML content entered by the user.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00695 · 52.4th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2024-02-19T23:59Z
EPSS history
Timeline
  • 19 FEB 23:59Z
    pyhtml2pdf 0.0.6 - Local File Read via Server Side XSS
    cvelistv5